111–120 of 202 posts
Earlier quoted context omitted.
I don't get why Github just hasn't hired the guy already.
In his earlier work at least, he's seemed like a loose cannon.
Earlier quoted context omitted.
As briefly as possible? Infosec is hard. Most companies have virtually no security policies. Nobody listens. Black hats are ahead in the arms race and anyone who has decent knowledge (doesn't even have to be anywhere near on a level like Homakov or Zalewski) can pull off all sorts of exploits. Even if they don't strike the application itself, they'll get you through infrastructure that your application relies on. Loo…
> Infosec is hard. In computer security, you have to get it right every single time. The bad guys only need to get it right once.
One of the keys to developing good software is hiring third-parties to conduct audits. A bug bounty program is one way to incentivize people who are already probing your software to take the next step and tell you about the bugs they find.
Earlier quoted context omitted.
There's a number of people who would like donate but not interested in consulting.. There were always people complaining "Add a donate address" Now "why you added a donate address". Oh, Internet.
Is there a way to guarantee you will spend donations on alcohol and not waste them on things like rent or food?
It's no guarantee, of course. :)
Earlier quoted context omitted.
In his earlier work at least, he's seemed like a loose cannon.
He was also very young then I believe, now he's realised he can make a lot of money by acting cool and professional so he does.
Earlier quoted context omitted.
"nothing" never happened IRL. I either work extra for free trying to find more, and punch myself until I find something.
There are always n+1 bugs. I presume the same could be said for security holes- especially considering they are sometimes the result of bugs.
Given a reasonably competent development team, you can usually make a first pass and find quite a number of low-hanging fruit security issues. Everyone makes mistakes, especially when under pressure to get a product out. Once those are gone you can use fuzzing and/or static analysis type techniques to find another set, but after that you get to the point where the bugs start getting quite obscure and require a fairly deep knowledge of how the system works so you can start stringing multiple problems together to get to a real security issue.
Of course this can be offset somewhat by the fact that software is usually a moving target, so if you're security testing a live, active codebase the developers are likely introducing new issues all the time, though hopefully at a reduced rate as they learn from their previous errors.
Earlier quoted context omitted.
There's a number of people who would like donate but not interested in consulting.. There were always people complaining "Add a donate address" Now "why you added a donate address". Oh, Internet.
Is there a way to guarantee you will spend donations on alcohol and not waste them on things like rent or food?
Earlier quoted context omitted.
Really great attitude. I would make this your tagline in some way - "I will find vulnerabilities. If I don't, I will become a vulnerability to my own body and attack myself until I do!"
Did we really just make an "In Soviet Russia" joke? That was appropriate? Man, I love this place.