Viewing profile — quotheth

> Why should an application developer implement a sandbox? Because they are the ones who understand the necessary capabilities of their program and the ones who have access to the …

I think this is the wrong attitude. No one is better suited to implement a sandbox than the developer of the application. The fact that most developers are not trained to do so is …

Great, I'm sure everyone else feels safe knowing you manually sandbox your apps.

How many apps do this?

Your argument seems to be that because there are multiple ways to exploit people that closing any of those methods is not useful. I shouldn't have to explain why this is not a mean…

Sure it is. If I have a Chrome exploit that I want to deliver to you and I'm on your network I can inject it into the webpage.

> It's impossible to get a valid SSL certificate for an appliance running within someone their lan Can you not just create a certificate and push it to the system as a trusted cert…

I'll assume you intended to write 'insecure'. I'd say the main issue is that anyone between you and that website can inject scripts into the site in order to phish/ exploit you.

OK, so in your example they create a certificate and use HTTPS and I'm unsure what the problem is. And why would they think outside of their internet only box when they're providin…

The "premature optimization is the root of all evil" thing is totally blown out of proportion. I think what they're saying is don't use that quote as a reason to write garbage slow…

None of these are likely the reason - it should be as simple as Java's own managed heap preallocating that space.

Do you think there's much overlap between the people generating reports and the people in charge of hosting their domain/ managing certs?

I can't tell what this post is implying - that sec analysts are like... a fake job? Can you please elaborate?

An attacker needs the ability to compute on your local machine. Javascript is the way to do that in a browser. With just CSS this should be impossible/ very unlikely. I guess it is…

I work for a company with a massive rust codebase. Rust is very much about building production code. What is 'good production code' ? * Few errors * Readable, well documented * Tes…

I personally find Rust quite a joy to read.

Yep, it's disabled by default. It is a great indicator of the forward thinking work they do, though. And from a corp perspective we can push out policies to enable site isolation f…

My point with site isolation was more their continued effort to push interesting, compelling security improvements. Currently, from a corp perspective, enabling site isolation for …

Vulnerability counting is never a metric for security when comparing counts across products. It's very helpful for counting within a product. One simple example - A and B are brows…

There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in …

I read posts like this and it's just so clear to me why we're so fucked.