71–80 of 202 posts
Earlier quoted context omitted.
0. I spent less than an hour last year because there was no proper motivation.
Ah. How did you get the motivation now? How long did it take to find these bugs?
Earlier quoted context omitted.
There's a number of people who would like donate but not interested in consulting.. There were always people complaining "Add a donate address" Now "why you added a donate address". Oh, Internet.
At least in my experience, I donate to groups that do good work but aren't getting paid for it. I wouldn't donate to people who are being paid (quite handsomely, in this case) for their labor. Especially when he's already clarified that GitHub paid him more than he thought his time was worth.
Firstly, well done. It is good to see well done security eval. But github, seriously? Why do you guys fail so hard at security? Too much Brogrammer rather than programmer methinks.
Earlier quoted context omitted.
As briefly as possible? Infosec is hard. Most companies have virtually no security policies. Nobody listens. Black hats are ahead in the arms race and anyone who has decent knowledge (doesn't even have to be anywhere near on a level like Homakov or Zalewski) can pull off all sorts of exploits. Even if they don't strike the application itself, they'll get you through infrastructure that your application relies on. Loo…
Good to know, thanks. Any recommendation for a good read on security best practices for a python/django app?
Here is some OWASP material specific to Django.
If you like reading http://blog.mikeleone.com/2011/10/security-django-and-owasp-...
If you like watching http://www.youtube.com/watch?feature=player_embedded&v=sra9x...
If @homakov is finding security holes without access to Github repositories, imagine what he'd find if you had him code audit for a few days... He's clearly been going about this the proper white-hat way and ensuring holes are patched before open disclosure... what's there to lose? On the flip side, you could go about doing what you're doing under the presumption nobody is maliciously targeting your user base. In thi…
Completely agree, GitHub private repos are a huge target. Even if you use 2FA, after login it's just a cookie that separates the good from the bad. How could GH improve that? Client-side SSL Certs?
Earlier quoted context omitted.
There's a number of people who would like donate but not interested in consulting.. There were always people complaining "Add a donate address" Now "why you added a donate address". Oh, Internet.
At least in my experience, I donate to groups that do good work but aren't getting paid for it. I wouldn't donate to people who are being paid (quite handsomely, in this case) for their labor. Especially when he's already clarified that GitHub paid him more than he thought his time was worth.
"P.S.2 Love donating? Help Egor on coinbase or paypal: homakov@gmail.com" Maybe it's just me, but asking for donations after saying you bill clients at $400/hr seems weird to me. I wish I could bill at that rate.
If you think $400/hr is great, you should see the rate for black-hatting :P
And that's before legal costs and possible restitution.
Earlier quoted context omitted.
"nothing" never happened IRL. I either work extra for free trying to find more, and punch myself until I find something.
Really great attitude. I would make this your tagline in some way - "I will find vulnerabilities. If I don't, I will become a vulnerability to my own body and attack myself until I do!"
Earlier quoted context omitted.
Good to know, thanks. Any recommendation for a good read on security best practices for a python/django app?
If you aren't yet familiar with OWASP, start there. https://www.owasp.org/index.php/Main_Page Here is some OWASP material specific to Django. If you like reading http://blog.mikeleone.com/2011/10/security-django-and-owasp-... If you like watching http://www.youtube.com/watch?feature=player_embedded&v=sra9x...