61–70 of 202 posts
> $4000 reward is OK. $4000 !? Wow, I'd love to be able to make $4000 on the side just doing what I love. > Interestingly, it would be even cheaper for them to buy like 4-5 hours of my consulting services at $400/hr = $1600. This sounds like a pretty clever strategy for marketing yourself as an effective security consultant. EDIT: $4000!? wow. so money. such big.
Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job. Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be ha…
As briefly as possible? Infosec is hard. Most companies have virtually no security policies. Nobody listens. Black hats are ahead in the arms race and anyone who has decent knowledge (doesn't even have to be anywhere near on a level like Homakov or Zalewski) can pull off all sorts of exploits. Even if they don't strike the application itself, they'll get you through infrastructure that your application relies on. Loo…
Friends don't let friends code in Fails frameworks.
If @homakov is finding security holes without access to Github repositories, imagine what he'd find if you had him code audit for a few days... He's clearly been going about this the proper white-hat way and ensuring holes are patched before open disclosure... what's there to lose? On the flip side, you could go about doing what you're doing under the presumption nobody is maliciously targeting your user base. In thi…
Earlier quoted context omitted.
95% of my security research is not paid. I fix gems, libraries, websites etc. Donated money go right there, through beers and coffee I need.
Perhaps you could clarify that part in your future posts, to appease the Internet haters on both sides. "I do paid contract work. However I also spend lots of time fixing open source stuff for free. If you want to encourage me to keep doing the latter, here's how to donate."
Ruby Brogrammer Security Fail yet again. Friends don't let friends code in Fails frameworks.
Earlier quoted context omitted.
There's a number of people who would like donate but not interested in consulting.. There were always people complaining "Add a donate address" Now "why you added a donate address". Oh, Internet.
At least in my experience, I donate to groups that do good work but aren't getting paid for it. I wouldn't donate to people who are being paid (quite handsomely, in this case) for their labor. Especially when he's already clarified that GitHub paid him more than he thought his time was worth.
He also commented on his site that he "is poor", so it could be that he simply hasn't landed enough gigs @ $400/hr to be in good financial shape yet.