Viewing profile — raesene3

Ah yes, so the threat model for developer signing is compromise of the repository. So here we're looking at the OpSec of the repository owner (e.g. PyPI, npm, Rubygems etc), and al…

On the flip-side how is someone who's using a package from one of these repository meant to validate that it's secure and non-malicious? without central validation, each user would…

Well if there's no central validation, that leaves all individual users to validate packages before use (which is a huge amount of work)... The problem is that companies are using …

Yep it's a really nasty problem for any package manager that operates at scale. The problem is that without any centralized validation of packages, it leaves checking to each devel…

nope and not only that it's not even supported AFAIK

This is very true, but execution at install time (sometimes with root privileges) is a bad idea from a security perspective, especially when it happens with dependencies, which mak…

One of the problems is that npm (and others) put their credentials or some form of API token into dotfiles in the developers home directory, meaning that if you can execute code as…

Indeed package signing is not the holy grail and won't solve all problems, but it is a part of a secure system. For the problem this blog post talks about, I personally think that …

Kind of amusing that this is considered to need a new vuln. report, I kind of assumed it was common knowledge. Most of the programming language package repositories (e.g. npm, ruby…

Unfortunately I don't think that many/any of the Programming language package repositories have manual review processes, or even automated checking for things like known malware...…

I must admit I don't really see this products major benefits over other ways of achieving the same thing (a secondary phone with call forwarding from the main smartphone). Their pr…

I don't think EV SSL certificates have been a big success (though that's just a personal opinion rather something backed with specific data) For me the differentiation in the brows…

on your second point, I'd be careful before making that assumption. Without evidence there's no reason to believe that a supplier company will have better security than your own an…

The Video is also up on Youtube and adds quite a bit to the slides including some good demos https://www.youtube.com/watch?v=nuruzFqMgIw&list=UUJ6q9Ie29a...

However, Micropayments are not the only alternative to Advertising, subscriptions are another choice which only need to be done once rather than repeatedly. I'd like to see more si…

sure but depending on who's paying and how many subscribers you have it can be a decent sized up front expense. I'd argue it's well worth it in the long run but a lot of companies …

Interesting article, I've always thought that phones are one of the weaker links in the 2FA chain (but a lot cheaper than dedicated tokens). The general use of SMS/voice mail has a…

Some of this kind of system won't actually hash the password but encrypt it and use an HSM to secure the keys. Wherever you see a password prompt where the ask for specific charact…

Very likely to be a legacy back-end system. Doesn't excuse it at all, but that's one I've seen limit banking systems in the past either in password length, complexity or case sensi…

That's different to the PIN. CVV is for cardholder not present transactions, PIN is for one's where you're there. Also CVV needs the 16 digit card number, card holder name and expi…

What makes you say that? Microsoft have been providing warning of XP going End of life for years now, and (AFAIK) they already supported it for longer than other OS vendors do for …

What I think is interesting about this is more the general case than this specific example. I'd say that people's social media handles are becoming more and more important to them,…

Interesting to see this hit big companies like google. The problem, I think, stems from the idea that most people treat XML parsers as a "black box" and don't enquire too closely a…

Hopefully one positive thing that will come out of this whole Heartbleed thing is that companies making extensive use of Open Source software for security critical purposes will co…