skysight-inc/HackerNews huggingface dataset:
Bisnis Sampingan Wanita Cilegon: Grosir Tas dan Dompet Wanita
Kaum Hawa Cilegon saat ini punya kesempatan memiliki usaha sampingan tanpa modal besar sebagai agen tas wanita dan dompet wanita dengan kwalitas impor, Koleksi tas dan dompet wanita lengkap dengan ...
First, we're a pretty big company, and I'm only one of 3 founders and of 4 practice managers, so you can imagine we've debated this pretty thoroughly.

Last point first:

Try real hard not to miss stuff. Seriously, that's it. Appsec is a competitive field. Forget scanners: many clients are going to hire a different firm for their next test, and some of those firms are really, really good. When you're testing an app, that is the thing that is animating your work: trying not to leave nuggets for the next team to find and shame you with. Think we're worried about missing things sqlmap finds? Try worrying about what iSec Partners is going to find.

To your first point: this is hard to articulate well, but let me take a stab at it: it's very hard to double back over terrain a scanner has already covered. Think of security testing like a treasure hunt. Have you ever had a fun treasure hunt? Can you get a bead on the feeling you had when you started out hunting for stuff? Imagine trying to put the same focus and motivation together if, before the treasure hunt, the organizers announced "we sent a bunch of people out before you to try to make sure there's no treasure".
No? In golf, there was recently a debate as to whether a (permanently) injured player should be allowed to use a golf cart when all the other players had to walk. There are already restrictions on binoculars, wind gauges, and other measuring tools and techniques. In racing, tracks have been limited in their efficiency. Clothing is restricted. Professional and Olympic racers have labs design shoes for them. In the context of limiting "enhancements", I don't see anything about prosthetics that would make them more of a slippery slope than what we've already dealt with.
As someone who used to be CISSP certified (way back in 2003), here's my advice: don't bother. The only reason I got it in the first place was because, honestly, I had more free time than actual experience. Otherwise it's a great way to bullshit your way into a job you're unqualified for in a shitty company.

Focus your efforts on actual learning, instead of proving through a worthless piece of paper.

edit: Just to drive the point home: 9 years later I still don't know shit about security.
Thanks for the information about reporting spam text messages, I had never heard about it. I just received some spam text the other day and ended up reporting it through the FCC, but reporting straight to your mobile operator on the phone is much nicer.

ceejayoz is right about Verizon also supporting this feature (I just reported the spam message I had from the other day). Via https://community.verizonwireless.com/message/696743#696743 :

From MikeS1_VZW

We have heard our customers on this, and we have launched a new program
to help with SPAM. Take one (or several) of the SPAM messages and
forward it to 7726 (which spells SPAM). This is a new process. Once you
forward the message to 7726, you will get a reply text message asking
the identity of the SPAM sender (the "From" address in the SPAM message
you received). Once received, you will get a "Thank-you" message from
the 7726 number. We will investigate on the back end.

The messages you send to and receive from the 7726 number are free of
charge. This is a brand new program we are testing, and it just started
on 09/1/11. Please make this common practice when receiving SPAM
messages. This is not to be confused with alerts though. If you get
alerts (something you signed up for), you should reply STOP to the
message received before going the whole 7726 route.
I think the idea is that they can be made to use more or less the same equipment as time goes on otherwise they'll not be allowed to compete. This is sports, not a free market.
"It seems Firefox is the only browser to adhere to the specification in this regard."

I fail to see how being the only browser to honour the specification is anywhere near being a "fiasco" (which is defined as "a thing that is a complete failure"). There's most likely a reason for the way the specification is designed, and in this case Firefox should get credit for being the only browser doing it correctly.
Sorry do you mean racers who are born with different capabilities, or golfers who use different clubs?
Physical inequalities - not mechanical.
This looks very similar to a library I created/am working on: http://keithcirkel.co.uk/jwerty/
Regarding abstractions, learn how to puncture them.
What I'm saying is that I have found that scanners are almost always a distraction at best, misleading at worst, and that they offer very little useful information about the app that can't be acquired more easily and efficiently by a tester reasoning about the behavior of the app for themselves.

I'm not against automation. I don't think testers need to launch every fiddley little query they need to gauge behavior. What I'm against are tools that run some unspecified number of fiddley little queries, do some bogus analysis, and then spit out a "YES XSS" or "NO XSS" answer.
But it's red on green or green on red, not differentiation between the two? I have r/g color blindness, I can't see red berries against green foliage, but I can tell red from green easily.
As prosthetic limbs can be and are switched out for specialized versions adapted to different scenarios, 'race limbs' are just another kind of sporting equipment.
"Never send the user a new password over email."

This is what HN does right now. I know, because I forgot my password just yesterday.
The Meaning of the Higgs
cool. I will give it a shot. I use google video chat regularly. Also, if you can add a way to easily share my screen (or even screenshots), that would be amazing. I have been wanting a way to 'push' my screen to coworkers, even within the same office.
Yeah, please elaborate?
Galaxy Nexus to go back on sale next week, says Google
No, it's a good attempt though. Most of his courses are too theoretical to matter or get anyone anywhere a job.
Why I quit Microsoft
Sorry that it didn't work for you. There's a bug which happens occasionally for some computers where we try to connect to the camera and fail and retry, and it looks like that's what you ran into. We're working on fixing it right now.
Totally agreed on everything! Let's do the HN Top 10. my suggestions (in no particular order): SQL injection, XSS, CSRF, force browsing, improper authorization, command injection, arbitrary file reads/writes, remote file inclusion. What else?
Intelligence agencies are primarily interested in providing disinformation to other foreign intelligence agencies.
It depends, really. Clojure's compiler actually does perform static, compile-time type analysis in certain cases, notably on primitives. For a more traditional form of static type analysis, I imagine you'd use the macro system to provide something like

http://en.wikipedia.org/wiki/Qi_(programming_language)#Type_...

That said, I'm personally of the opinion that compile-time static type verification isn't quite as powerful as is oft conjectured, in terms of safety and performance. Sufficiently expressive type systems pay some of the same costs as run-time verified types in terms of indirection, and in practice the difference rarely seems significant.

To be more explicit: I assert that C (and, for that matter, Java) do not have strong type systems, in the sense of power, not rigidity. There are huge classes of bugs in kernel code that could be caught by static type verification and can't, because the C type system simply isn't powerful enough to express the invariants required. Yet, somehow, people write successful operating systems in C, and they work not because of the type system but because of careful thought and thorough testing.

Even more to the point: We have written operating systems in dynamically-typed Lisp before, even down to the microcode level. The Symbolics Lisp machines should illustrate that it is perfectly possible to do what the parent asserts is infeasible.

All this said, I certainly wouldn't write an OS in Clojure; though I love the language, the JVM just wouldn't be an appropriate substrate. The instant someone announces an LLVM Clojure compiler, though... ;-)
It's refreshing to see someone admit to their mistakes and grow from them!
Just because you cannot set all variables outside the body to equal does not mean you should have a free-for-all.
A One Man Army On a Mission To Destroy The Cyberlocker Market
What about Acme-CPANAuthors-Indonesian?
This is a very good starting document: http://code.google.com/p/browsersec/

(Also, anything icamtuf touches is probably going to be good.)
Paid version, where all the sharing features drive traffic to my site and there is no Iorad branding would be worth the upgrade I think.
The Best Google Features You’re Probably Not Using
Chrome 20 on linux. Bug submitted: https://github.com/ccampbell/mousetrap/issues/3
The way demonoid "members only" works is you have to log in to their website with your web browser before the tracker will permit your IP to connect.
If he wins, people will be split over feeling happy for him and thinking he only won because of his prosthetics. If he loses, the media will spin it as a triumph of meat over machine.
skinny vagrant
A easy way to start VirtualBox vms from the command line \o/
True. The fiasco is more or less around the issue of discovering the root cause of why my fonts weren't displaying properly in Firefox, when they did in webkit.
I'd start with _The Tangled Web_ by Zalewski.
Sharing the screen is definitely in our plans for functionality we're building next.
The OP was talking about both. They said "properly designed visually". That's the interface. Then he said "and in terms of user experience, people could actually admire their PC's like they do in all of their stupid commercials".

"I don't know anyone who admires the UX of Windows"

Well, I don't know any users who don't admire it. I know users who have the occasional gripe, but overall most people that I know are very happy with Windows and simply don't want to use anything else.

"The user experience on Windows is distinctly subpar to every other operating system I've ever used."

OK. The user experience on Windows is distinctly exceptional to every other operating system I've ever used.

I've used them all too and while Windows may not have every single feature that you personally want, the UX is leaps and bounds ahead for the most important features. Basically, it just works. I cannot say the same for OS X or any Linux desktop where you have to fight with them to get them to do what you want.

Windows has such a great UX, such that if you don't like something, you can change or add it. You can't say the same for OS X. Apple doesn't even allow developers access to the APIs that they use...for instance, for their Dock. So, if you want to replace the Dock with something better...you can't. If I want to replace Windows' taskbar with a Dock...I can do that.

That's the experience that I want. I don't want to fight with the company or the group, to get what I want. You want virtual desktops in Windows? Add them. You want "better" multi-monitor support? Add it. Being the world's most popular desktop operating system has the advantage that many people have developed solutions for your minor complaints.

"Windows will still by default reboot..."

Most people want updates to be applied when their not in front of the computer. If you're in the minority, change the setting.
Or in other words you've decided to decree the world as flat.

I work in an AppSec practice. Scanners help me find the low hanging fruit. I can now spend more time looking for logic bugs.
I misspoke -- I meant to say "very unlikely to need replacing soon." Look at SHA-1, for an example of this sort of thinking -- there have been some security problems found with it, and SHA-2 is recommended for anything new, and there's a contest to determine what algorithm will be SHA-3, but people who are using SHA-1 are not in dire peril. It's the "walk, don't run, to the nearest exit" approach to security. You pick something strong and hope that, if attacks are found against it, this process will be gradual enough that you'll have plenty of time to build the infrastructure needed to support migration, and migrate.

I just think that starting out planning for password hash function migration, when it's easy to retrofit later, is a bad case of premature optimization.
Plus "fiasco" helps with the alliteration.
This is amazing, thus guaranteed to sell to one of the large screencasting/training companies quickly (good for the team!). What happens to all the free public stuff then?

Example buyout -> shutdown: http://philbradley.typepad.com/i_want_to/2010/06/screentoast...
Lie More, as a Business Model
"Goofy" cryptographic tokens? Is there a better way?
Thanks for thinking of us as a successful product! You just made our team's day (or rather, late evening) here :)

PS: this is Paras from Visual Website Optimizer.
Wow that is impressive numbers.

One thing to note:

"Bridge’s deepest competition will come from the legacy giants when Bridge starts working with large enterprise operations."

Yep, if you want to pick a fight, pick a fight with the biggest one guy in the room. Best of luck to this team!
>This could be improved by adding a second taskbar (I think this is coming in Windows 8?) but I think more is needed.

Yes, this is coming in Windows 8. http://blogs.msdn.com/b/b8/archive/2012/05/21/enhancing-wind...

>My biggest complain pre-Windows 7 was that you could not reorder items. I thought they fixed it, but they actually made it a lot more annoying with W7. I think Windows assumes that each window of an application is related to the other windows (never the case with my workflow) and so you cannot separate them by dragging. Say I have 5 Firefox windows with a few tabs each, where each window's tabs represent a collection of related topics. Now say I have some Word and Excel documents also open that relate to the browser windows.

You can ungroup windows in the taskbar with 7 Taskbar Tweaker http://rammichael.com/?proj=29
If you want to start doing security, I think it is more important to learn a fundamentally different perspective. It's sort of like learning magic, where the new perspective is 'What will my audience assume automatically? How can I get them to think that a given hat is empty?' (If it's a baseball cap and you drop it or invert it or so, for example.)

In security you're asking a similar question addressed instead at yourself. You're asking, "what am I assuming automatically?" Schneier for example has talked about why pilots don't get reduced screening at airports. The problem is that the pilots who cry out, "this is absurd, I could crash the plane I'm flying, how could I possibly be more of a risk to these people?" don't realize a certain automatic assumption: the assumption that the only people wearing the pilot's uniform are fellow pilots.

I tell this story occasionally, sorry if you've already heard me tell it. I once corrected a major security leak in an application I was paid to help develop -- the leak existed in the dev but not in production (thankfully!). The problem was that the team who had asked me to help out had made an assumption: "logs are good and are one of the only ways to create an audit/revert trail, we should log every request which comes our way just in case." This was built deep into the system. When I heard that, I was almost floored. As a proof of concept of the seriousness of what I'd realized, I looked through the audit logs for my boss's dev password and sent it to him.

It's a fundamental perspective shift: "if I wanted to break this, what assumptions could I use against it?" Whenever you see an implicit assumption you ask "how could that come back to bite us later?"
Are there training advantages in immunity to injury below the lower knee? How much training is generally constrained by the resilience of the foot and ankle?
Those questions were always offtopic (even though they were tolerated in the early days.) Migrating them to marginal sites is better than deleting them.
To be clear, I was bringing up this concern not to protect the recordings (although I do agree that is an interesting point, albeit one easily solved by the "stream it to the Internet" mechanism), but to point out a practical issue with using your cell phone as the recorder: your cell phone probably has a lot of other things on it, from call histories to SMS logs to photographs, any of which you might not want a police officer randomly digging through "on a whim"; hence the advice people offer to keep it locked in a glove compartment in these situations.
In my experience, the software architects I've known were turkey farmed into their roles because the management structure couldn't figure out what to do with them. Most were actually good at coding, not very process-y, and carried good opinions about software design. As developers, they were rightly recognized for their contributions and promoted for them. But as architects they became organizationally peers to management, and they invariably got sucked into internecine management politics, which neutralized their abilities.

The irony of this is that I think all software engineers should carry these traits. Having software architects just stuffs this role into a handful of people instead of spreading it throughout the organization.
No need for hard real time, first level detector output goes through FPGAs which only pass potentially interesting data to the Linux powered systems which do further data filtering.
you are going to get lot of criticism for the title, and first page. just a heads up.
Pusher?
It never occurred to me that you could include an encoded font in the stylesheet. Perhaps this not only eliminates a request, but it fixes Flash of Unstyled Text (FOUT) for browsers that support data-uri's.

http://paulirish.com/2009/fighting-the-font-face-fout/
Steve Jobs would always bait and switch: "You know the bla bla is a really dumb idea, so Apple will NEVER do it" followed by introducing the iBlaBla about two years later. In fact it's easier to to guess what they'll roll out by what Jobs "hated" rather than what he liked...

PS I really miss Jobs, without him the industry seems dull...
Beautiful letter from Scott Fitzgerald to his daughter
It would be a silly thing to do because you keep exactly the same problem you'd have without stored procedures. Would the client you're writing rather execute something along the lines of

SELECT sp_enroll("bob\"); DROP TABLE students; --");

or

SELECT sp_enroll("bob"); DROP TABLE students; --");

?

At least if you grant the user only SELECT and EXECUTE privileges and define the procedures using the SECURITY DEFINER property, you could still prevent this type of damage. (This relies on the procedures to be as strict as possible or the whole scheme essentially fails.)
So did oxygen ... and food ... and beverages.
Here's the thing...just because you aren't getting something exactly the way you want it...does not mean that the UX is somehow awful for every person using it.

Furthermore, Windows has left the hooks available for people so that they can change something if they don't like it. That's the best UX present any company can give you.

There are plenty of apps out there to modify Windows. As a matter of fact, there's very little that can't be modified. Why don't you just look around for some program to do what you want?
Salted password hashing plain and simple:

Rule 1: Use a Modern Hash Algorithm (bcrypt, PBKDF2, scrypt)

Rule 2a: Use a Long Cryptographically Random Per-User Salt

Rule 2b: Have an additional 'system' salt that is a fixed value for the entire system and it's not stored in the database (better hide it in the source code)

Rule 3: Iterate the hash

Source: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

------

For ASP.NET the only proven option for rule 1 is PBKDF2 which is builtin (http://msdn.microsoft.com/en-us/library/system.security.cryp...)
Translated from patentese:

- Two or more windows displaying data from different sources

- The sources have sections

- Sections from one source have corresponding sections in another source.

- Changing sections in one window makes other windows change to corresponding sections.

- Basic message-passing communication to implement the above.
Feels kinda like an evernote designed around code. I kinda like it..but you should offer some explanation somewhere. I hate having to look around and not know what this does. Also..a way to sign out would be nice. (Unless I missed that. I only perused for about 15 seconds)
My list:

1. DOM Corruption / Javascript Injection

2. CSRF / Clickjacking / Reframing

3. SQL / db-metacharacter Injection

4. Authorization/Forced-Browsing

5. Unauthenticated Encryption and Bad Block Cipher Mode Handling

6. Filesystem/Backend Storage Path Sanitization

7. Exposed Admin/Diagnostic Functionality

8. Memory Corruption Vulnerabilities in Native Code Extensions (cext gems, &c)

9. Shell-out Command Injection

10. Insecure Password Hashes

I feel like mass assignment, resource exhaustion, filter return code mistakes, and wildcard routes all belong somewhere, but they feel too Rails-y for a generic list.
Incident Response and Malware Analysis Keys to Solid Network Security Career
I just hope the cops don't respond by routinely confiscating smartphones of everyone they stop. "Sorry, but I suspect you are smuggling cocaine inside the case. Don't worry you'll get it back. Well I mean you'll get the pieces back. In three years."
One problem worth solving: how to choose an area to live in ?
I thought to share this with all of you. One of the biggest problems I have constantly faced is deciding which area to live since I have moved many times in my post college days until now. Obviously, there are guiding factors such as place of employment, family, friends, preference (city life vs suburbian) etc. What if there was an app that interactively asks us these questions and suggest some zipcodes/places to live ?

I for example want to know that if I work in NYC and my spouse works in the suburbs of NJ (actually true in my case), where should we buy a house? Logically, should be somewhere in the middle of the 2. but where, why, how ? May be we are not as interested in good school districts at this time? May be I want to live at a walking distance from a major train/bus station ? Possibilities are endless here.
Carriers hate to be called as "dumb pipes" but unfortunately they have become the dumb pipes only. Any idea why Verizon blocked Google Wallet? Isn't it illegal?
I agree. Overwriting the close tab and next/previous tab shortcuts causes me a lot of frustration. Thankfully few webpages do it.
This is a point where you'll have to judge the security considerations against usability considerations. As a user I might end up hammering a web service with correct passwords but incorrect usernames. As a user knowing that I'm using the wrong username would be useful and keep me from getting frustrated.

A better solution would be to rate limit incorrect username guesses. It's highly unlikely that a user is going to try more than a dozen usernames/emails - so that's strong signal that someone is trying to leak username information from your database.
1. 'wet dream' reference in title.

2. Anatomically implausible female assistant.

3. In yoga pants.

4. Who calls you 'Honey.'

Yup, sounds about right.
Why would you think shame would have any effect? Shame does not lose court cases or reduce patent licensing fees. You can't stop a patent troll by any means that does not directly affect their revenue.
Unless Facebook overwrote their phone numbers with 1-800-[friends name], this is a pointless argument and completely out of context.

Facebook's issue was email. This is phone number SMS.