Viewing profile — marcinw

(I am one of the developers of Doorman). Some background, from osquery's site: "osquery allows you to easily ask questions about your Linux, Windows, and OS X infrastructure. Wheth…

Proper Python would use the csv module for this operation, as your CSV export would break if `header` or `dataset[key]` contains a comma.

Matt Levine sheds more light on this story[1], backed by evidence whereas the NYTimes is just hearsay. Why would Barclay's screw over institutional investors who account for a larg…

In addition to SQL injection, many "advanced search" engines will compile regular expression patterns from user input. Depending on the language, this can range from a simple Regex…

Right, like getting access to the DOM was ever a hard thing to do. I was specifically referring to web apps in that point, but because you insist, I'll just reference [1]. Another …

Java, Python, etc don't have a DOM to consider. When you're just an XSS away from an attacker doing: function encrypt(plaintext) { $.post(plaintext, ...); return plaintext; } then …

And that's your problem. I was the same way, though I live in NYC. With every pay raise I upgraded my lifestyle. Whether I was making $50k/year or $100k/year, I wasn't saving anyth…

Quitting social networks and using Tor and PGP isn't going to protect you from a nation-state intelligence agency. To suggest so is laughable and naive. We're not even at amateur h…

I hear people say all the time they drink a lot of water, but when you ask them to measure it out, it's a joke. The answer to this problem is to sit at your desk with a gallon of w…

We've solved this in the Matasano NYC office by: * Going downstairs for coffee * Playing a round or two of darts

When I worked in machining, we all had anti-fatigue mats at our stations. Everyone wore Red Wing boots (sneakers are terrible for you), and I heard no complaints of foot pain.

For one, a built-in theme editor that exposes you to remote command execution in the presence of another vulnerability, such as cross-site scripting (XSS).

We're working on it, but you can expect to start them this evening.

Neils Ferguson, et. al of Cryptography Engineering (p. 95) suggest that truncating a HMAC-SHA-256 to 128 bits should be safe, given current knowledge in the field.

When it comes to the social stigma of taking a nap at work, just ask if they'd prefer you take a smoke break every hour. Usually, people will get the hint. If not, too bad.

Am I only the person ever to like Load? I know it's not their best, but I still enjoyed it.

Hmm, where to even begin.... I take it you've never ridden the subway.

-I is an HTTP HEAD request (which may return a different response code than a traditional GET). To print the headers in any kind of request, use lowercase -i.

Wow, 61% of websites that responded with an Access-Control-Allow-Origin header had a value set to "*". This allows for the website to be access in a cross-domain manner (think XSS,…

That's the trick. I find having a coffee and then closing my eyes for 15 minutes leaves me more relaxed yet full of so much more energy than before to take me through the rest of t…

There's plenty of those to go around...

I must admit, as an American male, a little older than you, my score was also so low, I'm too embarrassed to even mention. All those years of cheating on vocabulary tests (merely b…