Viewing profile — julie78787

[Disclaimer: I work for AgileBits. I also started the #slack-murderer hashtag inside :slack: before we switched over. My opinions are my own. Just ask anyone at AG!] "Slack is hero…

No, it's pretty spot-on. People try to divide security vulnerabilities into "super-obviously-bad" and "no one will ever find / exploit / do much of anything with it." The problem i…

The problem is that quite often security professionals say "No", provide reasons, and the person doing the asking insists that convenience is more important than security. My favor…

Except that you can attack stored encryption secrets either off-line, or with the same privileges as the user. If they are hard-coded in the binary, they can be extracted off-line …

But even if they could, UNIX domain sockets aren't immune to attacks. That sort of the problem with "First, assume your machine has been pwn'd".

Not necessarily. Malware only requires privilege if it is violating a security policy. There are a variety of attacks in which a process executing as a user is able to access resou…

Correct - Least Privilege says you do the absolute least you need to do in order to make things work, so that any errors are limited to that one part of the system. What's been don…