Viewing profile — jsulinski

We definitely don't want to discourage you from contributing. It also doesn't necessarily have to be money, you could stake reputation you've previously earned. The dupes problem i…

I agree with you, they aren't very informative. We're big fans of BugCrowd's work in this area, and intend to adopt their VRT, though we're still considering how to make P1/P2/P3/P…

Hah, yeah, this stuff is hard and acquisitions make it even harder. I think you started a month after I left. We built a lot at MoPub in a short period of time and when we were acq…

Hey all, we're James and William, founders of Federacy (YC S18). We're building a bug bounty platform for startups. ( https://www.federacy.com ) I was an early engineer at MoPub, r…

Draft | Operations/Backend/SRE/DevOps Engineers | New York, NY | Onsite | Full-time | Salary: $135-$170k Do you... Enjoy building scalable, distributed systems with automation and …

How does this compare to say, Aerospike, or Honeycomb.io?

I don't fully understand the question. clair does static analysis vuls uses a package manager and changelogs

The conversion of package version numbers to vulnerabilities is perilous and incredibly complicated. That's one of the most significant challenges that we want to solve, which is e…

That's correct, vuls queries the package manager for installed packages, versions, and changelogs. It then compares the CVEs found in the changelogs to NVD. There are certainly fla…

This is a very well-written explanation. The only exception is when people have access to the underlying container, willing or not. Then these vulnerable binaries can lead to a vul…

Thank you. I'll definitely be reaching out.

Good point. What I meant was comfort moving away from a major distribution. NixOS is another distro that looks interesting.

Fixed!

Thanks sir! I redesigned my landing page and made it static; forgot to update the confirmation email link. The command is a standard 'wget/bash' script that you will receive when y…

To add a bit of detail here, one of the most surprising things I found that I'm saving for my next post is: 24% of recent vulnerabilities in the NVD have no rating, and that doesn'…

You're spot on. These are two of the things I intend on working on next. Thanks for the links.

Absolutely. Huge props to CoreOS and the Kube community for pushing forward with this stuff. I gave Clair a shout out in the article, and I intend on adding it as an optional scann…

Absolutely agree. I did see some bad practices in the Docker community that I expect to see elsewhere as well. Specifically: reliance on deprecated images and not updating images d…

I did some market research before I started working on Federacy (which began as frustrations I encountered at mopub/twitter). It seems that very few companies sub-hundreds of emplo…

CentOS/RHEL have a very small footprint in the open source community, it seems. I was pretty surprised by this because they have such significant corporate backing, a lot of enterp…

Absolutely. I intended this post to identify (some of) the problems/challenges. My next post will focus on how to address them. Alpine is definitely one of the major points, as wel…

I don't know the answer to this, but I do know that Alpine has some really awesome stuff around vulnerabilities, and I would presume that they react to vulnerabilities more quickly…