kyled

They did this on Mythbusters and showed it was possible.

Can you work on whatever stresses you out at work?

If not, find a job that doesn't stress you out?

Namespaces solves this issue, no?

Self plug =).

Check us out at https://oneupsecurity.com if you're interested in secure software development.

Always great to chat with businesses who are passionate about security.

The module is unmaintained. Who do you suggest should do it? Will you?

Yes. I am contacting the security team and working on a patch already. The page mentions someone is currently working on the issue already however.

"This software is broken so you shouldn't use it" is absolutely a perfectly reasonable solution.

I don't completely agree. If it's unmaintained, new installations shouldn't use it, totally agree. That doesn't help the 120K installations which are using the plugin though. It may take more time to impedance match apis, rather then fixing the security issue.

Looks like someone is writing a patch already.

Looking at the source it took me < 5 minutes to find the actual vuln =/. Drupal saying "Just migrate away" is not the correct way to handle this disclosure. Some people can't switch immediately. A patch should be made available, and the module should be depreciated. Does Drupal have a way to update modules easily? If not, there should be...

And yet people think I'm crazy for wanting to wrap get time functions so code can be tested...

Ah, yes some areas are lacking. I am more concerned about correctness though. Do you ever find math material that is completely wrong on Wikipedia? Stuff like number theory, abstract algebra, and category theory seem to hold up when I cross reference. I'm in no position to qualify myself as mathematician though, I just enjoy mathematics a lot.

Curious, what areas do you find are usually flat out wrong?

The math sections seem to be pretty good. A friend found a flaw in a crypto algorithm though.

I thought that was a camera lens.

I remember asking for a smaller monitor and getting some weird looks. To much screen space and I'm always turning my head left and right, was hurting my neck. I prefer virtual desktops and a tiling window manager.

They're pirates, and probably will kill you either way. Best to jump ship and hit em with some ads.

That's really inspiring that you started your own business! I would love to hear more about what you do.

I'm dealing with some personal stuff and feel like I'm in the same boat, having to start my own business to have the flexible hours that I need. Any advice you can pass along would be appreciated.

Usually I diagram the very high level architecture of the program. Anything lower is to volatile and wouldn't reflect the design due to code changing all the time.

Very cool!

Root by itself does not break security entirely. Selinux policies and capabilities assigned to binaries can be used to drastically mitigate privileged processes from doing much harm.

Not a fan of solely using fingerprints for authentication. Good systems allow you to rotate keys. I only got 10 fingerprints.

Can you go into more details? Why did something take 30 minutes or longer to build? Was the environment being cleaned every time? Was an artifact server not being used?

Category theory!

It's cool to learn recognize how simpler math concepts apply to computing. Ie, associativity allows for map/reduce

"Public-key encryption was revolutionary for a simple reason. It solved the age-old security problem of key distribution."

Not by itself. That's what protocols are used for. A weak protocol would allow for an attacker to intercept public keys, allowing the attacker to mitm communications.

Sorry to hear about your wife, I hope she is okay.

I actually miss SD and think SF is a bit overrated haha.

What did your firm do?

Gifjar! https://en.m.wikipedia.org/wiki/Gifar

Very nice.

This sounds very similar to the Time attack from 2013. https://youtu.be/rTIpFfTp3-w . I hope they got credited.

They used a timing side channel attack to extract data from a response when compression was enabled and user data is reflected back in a response. This attack can be done inside the browser and abuses how data is segmented when sent over tcp.

My first real job was with a small non tech company. They wanted to move to a digital system for processing orders.

Did you teach yourself most of what you know before going to college? If so, up play that factor. Being able to teach yourself and answer your own questions goes loooong way. What have you been working on in the past 14 months?

Companies want to know how you can provide value to them. Be proud of the work you have done and talk about a interesting problem you solved. Giving clear cut answers is always good. Be confident and passionate, but but not cocky or ignorant. Try to avoid the words "I don't know" . If you don't, then explain how you would find a answer to the question. Always follow up the interview with a thank you letter, making it personal is key.

Go to a company hosted meetup event, mingle with the employees and if your interested let them know.

Look for events that require participation from those attending and help others when they are stuck.

Stick out from the crowd and you'll be good.

Thanks for speaking up.

Meh, i wouldn't say impossible. I worked with amazing people. We were able to hit our goals consistently. Key is to have a great team who knows what they are doing and are honest. Measure by complexity, not time.

Unless you worked on a few products, your going to be bad at estimating larger pieces. A lot of software is very similar.

Thanks