« first day (3233 days earlier)      last day (25 days later) » 

12:29 AM

Software Engineer - Experienced Level

National Security Agency

Responsibilities The professionals at the National Security Agency (NSA) have one common goal: to protect our nation.…

Posted on Stack Overflow Jobs on October 21, 2019

9 hours later…
9:06 AM
Feds are hiring again, I see
@ConorMancone Most likely a "I have no idea what I am doing" person
9:31 AM
New MegaDrive album for all your hacker needs
2 hours later…
11:29 AM
Huh, Chrome 78 is killing the XSS Auditor. I know the tool had it's issues, but I'm a bit surprised anyway
11:55 AM
@ConorMancone Why though? They made their reasons pretty clear
It breaks some (although badly designed) websites, it can be circumvented with relative ease, it requires a lot of attention from the devs and there are much better ways (e.g. CSP) to do it right.
I personally am very happy to see it gone.
@ConorMancone And regarding that chrome:// question. Why on earth would anyone think that it works like that?
12:11 PM
@MechMK1 Then it probably would have helped if I had read their reasons :) I've kept up with some of the challenges the XSS auditor faced over the years, but hadn't realized they had risen to the level where it was better off not existing
I think the primary reasons for it to cease existing was that it was not effective at what it was supposed to do, and that it supposedly even introduced new security flaws
From an architecture point of view it's understandable. It's another moving part, that doesn't move well, is really redundant and just serves no purpose
Sadly I will not be joining you guys as official members of the security community (aka I got turned down for the application security engineer job I applied for)
@ConorMancone Oh no...
It's okay. It's a transition I want to make, but it will just take some time. I'm not hard-up for a job, so worse things have happened
I've been playing around with the idea of getting a certificate or two. I might do that, and also try to more proactively use my job to practice some additional skills
That's certainly a good thinking
12:18 PM
A big part of the job was performing threat modeling with the engineering teams before they started their sprints, and I've never done an actual threat modeling session before. As a result I knew I wasn't a slam dunk
And to brighten up your day, my 2FA code just now was yEa42069
@ConorMancone Threat modeling is only one part of the story, and really nice in some situations. As a pentester, for instance, you rarely need it.
It's more "constructive security", rather than "destructive security"
You do penetration testing, right?
Yes I do
Do you ever do bug bounties on the side?
(just curious)
No, I don't really have time for that. I know a lot of people here do bug bounties or CtFs or RE challenges, but I don't want that
12:21 PM
I've tried a bit, but never given it enough time to have any success.
The problem with bug bounties is that you never know if there will be light at the end of the tunnel.
I know after a week of pentesting an app, I will have a report and there may or may not be any vulns in it. It doesn't affect my paycheck
Full-time bug bounty hunters spend like 90% recon and like 10% actual exploitation
And your monthly income is directly tied to all the bugs you find. No bugs, no income...
I prefer spending my time playing videogames and painting minis. I need more "life" in my work-life balance.
I started doing it a bit as a part of my attempt to move more directly into the security gig. I have learned quite a bit doing it, although I only submitted one bug report.
That's great though!
Closed as "will not fix" of course :)
I could tell you war stories of bugs that customers refused to fix, would I not be under NDA
12:30 PM
Oh, I'm sure.
That was actually a question I got asked a lot in my interviews
"How would you handle a situation where you think there is a security concern but management disagrees"
I personally would ensure that the risk is properly assessed and that there is a dedicated risk owner.
Provide clear proof of concept, try to clearly explain cost of breach, but at the end of day if management doesn't want to fix it, it is there money on the line, so :shrug:
Oh, fancy words. /tuckawayforfuture
Yes, basically any vulnerability the company becomes aware of immediately becomes a "risk"
And the company has to decide how to handle that risk. Sometimes "doing nothing" is the right choice, e.g. if the likelihood and severity are very low, and the cost-to-fix would be too high by comparison
But my key takeaway point should be "Make sure someone is responsible for it and understands what the actual risk is"
@MechMK1 lol, indeed! A concept missing for everyone who asks, "Is this secure?"
Oh yeah, much better answer
I hope it helps you in your future endeavors.
A good example for a "won't fix" is a user enumeration thanks to incrementing user IDs.
An attacker can determine usernames and number of users. User 1 is likely to be the admin account.
Yeah okay, that's true but we won't change our entire database, rework our authflow and invalidate tons of links to us just because of this
12:37 PM
@MechMK1 As someone who is in our business systems as an admin with userid=1, I understand how that happens!
An agree - I'm well aware of the risk that poses, but I know my boss would have no interest in fixing it
although it could be fixed without having to redo everything.
If I were starting from scratch I'd probably use something like UUIDs instead, but it's never been the highest on my list of security concerns
It would still be work, and the risk owner has to decide how likely it is that this risk becomes a concrete problem, and how much impact it would have.
I completely understand devs of some system just being like "We'll just autoincrement user id's" because that's what I would do too
Q: I've been using my boyfriend's phone Privacy

user220363I've been using my boyfriend's phone for a few months I never use Bluetooth cos I don't know what it is or what it does. Today he borrowed my phone to go on Facebook later on I noticed the Bluetooth symbol was on the top of my phone I swiped down and pressed on blue tooth and under the symbol the...

Not even sure what to do with that one...
@ConorMancone Girlfriends going crazy because something happened and they have no clue what's going on really hits close to home :/
Oh yeah, sorry :/
No problem
It's not meant to address you, just these kinds of people.
I always see questions like "I checked my boyfriend's phone and saw something I don't understand. <Is he cheating on me?>"
The last part is often implied, but it's there in their heads
It just makes me so sad. If you can't trust your partner and feel like you have to go to a set of random strangers with little more than a hunch of what may be happening, then you seriously need to reconsider your relationship.
12:52 PM
Yeah, I've seen a ton of questions like that on SO. They usually don't make it over to security though.
Given the state of relationships these days, unfortunately they're probably not wrong more often than not
Given the experience of people around me, healthy relationships are few and far between
I've seen some here. I remember one woman saying that her boyfriend told her he was in "that city" but his IP address showed a nearby bigger city and she's worried he's cheating on her.
I am so far away from a healthy relationship. I am slowly going to the point where I ask myself if being alone wouldn't be better for my mental health.
I wanted a relationship where me and my partner could depend on each other. What I got was a relationship where my partner depends entirely on me and I can't depend on her.
It is essentially like living with a teenager, even though she's 21.
Those are hard situations to get yourself out of, whether that is through your partner becoming a more functional person, or simply figuring out how to extract yourself. It's tough, and having a stressful home is definitely no fun
Why do you think I am always in the DMZ while at work?
Work has essentially become my "free time"
Q: How does hacking work? How does a hacker spy on a system?

Linux_user0987According to my understanding a hacker has two options to spy on someone. He can trick the user into installing the spyware himself or if that doesn't work he has to find a service that the target is using which has vulnerabilities that he can exploit. If he finds a vulnerability that allows him...

I present you: The definition of "Too broad".
Q: I've been using my boyfriend's phone Privacy

user220363I've been using my boyfriend's phone for a few months I never use Bluetooth cos I don't know what it is or what it does. Today he borrowed my phone to go on Facebook later on I noticed the Bluetooth symbol was on the top of my phone I swiped down and pressed on blue tooth and under the symbol the...

Jesus someone is getting mad
1:22 PM
She got 4 downvotes too. That's pretty unusual even for bad questions like this
Maybe people are just fed up with bs like that
I'm guessing she's not in a good place mentally: the chances of engaging with her successfully were probably low from the beginning
She wanted to hear "Yes, your boyfriend is 100% cheating on you!" and any other answer would have been met with "y u ppl gotta be so rude 2 me!?"
Pet Peeve of mine: I absolutely hate when people use abbreviations like "ppl".
ya m8
And Emoji
1:26 PM
@MechMK1 lol, it hurt me a little inside everytime I saw ppl. I was literally thinking that exact same thing.
I have this deep hatred for excessive emoji usage
Like, I don't mind when people write something funny and end it with :D and it automatically substitutes :D with 😁
But people 😊😊😊 who use emoji 🀫🀫🀫πŸ€ͺπŸ€ͺπŸ₯ΆπŸ˜‘😳 after almost every 😲😲😟😧😩 part of their sentence βœβœ’πŸ–ŠπŸ–ŠπŸ–ŒπŸ–ŠπŸ–‹ just freak me the fuck out
Emoji use doesn't bug me as much (when used sparingly), mainly because tone is so hard to read over text, and a smiley/grumpy/frowny face avoids a lot of confusion
@ConorMancone It's hilarious, because I have the exact opposite problem with them, namely that modern emoji usage is so ambiguous
It's almost as if the English language has words that can be used to concisely express a wide range of thoughts and emotions, if one were only willing to invest more than a moment into writing something.
@MechMK1 lol, it's not often that I get accused of being lazy :)
Not you
But when I talk with people who do use emoji excessively, they say that emoji express things in a way that they never could.
1:34 PM
@MechMK1 I used an emoji once. People paniced
The giphy add-on on slack is my favorite thing. I really overuse it. It makes me sad that I can't use it here
(but it makes everyone else happy)
I mean, I'm sure there are no words in the English language that can express "πŸ†πŸ’¦πŸ˜œ"
@JourneymanGeek Rightfully so
@ConorMancone I remember that I overused memes so much that once during a kickoff meeting I accidentally said "yeet"
@MechMK1 /giphy embarrassing
Once we had a meeting where the fire alarm started and nobody would move until an email came in saying the building was on fire.
The business world is weird.
Yeah, I've totally ignored fire alarms. I've never had one that was actually caused by a fire. It's like the definition of "alert fatigue"
1:42 PM
Pretty much. Though I had one funny fire alarm story when I was in primary school
We were told that there was going to be a test fire alarm, and that we should all be calm, follow the teacher and do as the teacher said.
One girl was absent while we were told that, and everybody assumed that someone was going to tell her. Then we eventually all forgot.
My all-time favorite meeting story ever was at a place that manufactured body armor, gun holsters, etc... Totally looked around the room at least once to see people pull guns out of holsters and start playing with them (usually checking the fit of a new gun holster). You don't normally expect to see people waving around pistols in a business meeting...
The big day came, and then there was the alarm. Everybody was like "Ah yes, I remember", except that girl. She FREAKED THE FUCK OUT! Like literal life-and-death panic.
First she screamed, then jumped out of the window (we were on the ground floor so it wasn't a big deal) and then ran away screaming
Apparently she ran all the way to her grandparents on the other side of the village
@MechMK1 That seems a little bit of an over-the-top response even if the building was on fire
That's both hilarious and probably really embarrassing for her...
It was a bit over the top
It was both hilarious and embarassing :D
But at least we learned that if there was an actual fire, she would be the first to abandon all rules and just GTFO
@MechMK1 I have one signature emote ;p
2:01 PM
@JourneymanGeek Please do tell
@MechMK1 I did!
Ah, the ;p
I personally don't mind emoticons, or even some emoji.
I'm too old to understand emojis - I was trying to figure out the one @MechMK1 posted up there. I assume it's rude :-)
I only use :-) ;-p and ones like that
@RoryAlsop It's supposed to symbolize an ejaculating phallus
Fair enough
On a face, I guess
2:06 PM
For example, 💜 is pretty self-evident and unambiguous in most situations.
But what purpose do 🔛, 🌁 or 💯 mean?
Nope, I don't understand that one either @JourneymanGeek
@RoryAlsop flags ;p
I understand 100 - it signifies great approval or agreement
@MechMK1 I really feel that emoji need to have alt-text and such
for people who don't know what they are, and for accessibility
2:08 PM
They sort of do in slack
I know that 100 is used for approval, but that is deeply arbitrary
But generally I just ignore them. I am much happier reading sentences with correct punctuation and grammar.
@RoryAlsop I mostly use them ironically
You could argue that πŸ‘ is arbitrary as well, but it's a well-known symbol
Its probably rude in a few places
2:10 PM
Another problem I have is that many emoji have countless variants, such as πŸ“ƒ, πŸ“œ, πŸ“„, πŸ“° and πŸ“‘
@JourneymanGeek Yes, I am aware it's not entirely unambiguous. But it was good enough for facebook to adopt it as a universal symbol of approval
Even βœ”οΈ is not universal, as the japanese prefer β­• to indicate correctness.
@MechMK1 Wow, I totally did not get that.
The eggplant is considered one of the most used emoji for precisely this reason. Close follow-up is πŸ‘
I'm sure you can guess what that is supposed to symbolize
Another problem I see with emoji is that they aim to represent "anything". Abstract places (the office), specific places (the Tokyo tower), all kinds of food, emotions, professions, activities, etc...
This inevitably leads to "This thing has an emoji, why not that thing?"
"The Unicode consortium considers X less important than Y because X has no emoji while Y has one"
It completely neglects the idea of Unicode, to represent every glyph used in any writing system by humanity.
by assigning emoji to all things, we essentially have to emojify everything
Just as we came away from political discussion, Vipul yeets this masterpiece into the DMZ
I'll just abstain from making my comments. You probably already know what I'd say anyways.
@VipulNair Pot Stirrer! :p
Hahahah.Sorry about that
I didnt even read the earlier message.just pasted it here.
It's fine, don't worry about it. I just think after the discussion between Tom and me, people are perhaps a bit tired to discuss such topics.
wtf is going on in china?
2:43 PM
Do you want the long version or the short version?
I mean how do humans even do stuff like that
The answer is "Because China"
Because China has money, and because everyone needs China. That's why they can get away with everything.
Because your phone is made in china, your clothes are made in china, your TV is made in china, etc...
And you may say, "No, that's not made in china. That's made in somewhere that's not china", and that may be true on the surface, but the components were made in china.
We let them do whatever they want, in exchange for money and products.
I meant more like why would Chinese people do this shit
Whats wrong with just peace.
@VipulNair That's not how people work.
2:51 PM
Peace and co-existence are all well and good, as long all parties involved actively want to pursue that goal.
And again, the DMZ starts to get interesting just as I am about to leave.
But peace is pretty sweet tho
people's priorities are all messed up i tell ya
Alright, let's do a thought experiment:
Everyone dies eventually you might as well live in peace while you are here
@MechMK1 go on
Imagine five groups, all living together. People naturally want to support their own group, but they have no problem helping people from other groups.
All people in those five groups share the same ressources, be it jobs, land, actual resources like water or food, etc...
Imagine, one group thought to themselves that they could be better off if they would not support the other groups anymore.
They would still be supported by others, but not give back anymore. At some point, that group would cause problems in the system. Other groups would either stop supporting that group, or start becoming selfish as well.
The problem is that "being selfish" has more net-gain than being supportive. As a result, everyone wants to be selfish.
If all 5 groups are selfish, everybody loses, because every group has some surplus (that they can't get rid of) and some deficit (that they can't satisfy)
Everybody is off worse in the end.
isnt that short sighted?
2:58 PM
Yes it is, hence the lesson that supporting each other requires good-will from all parties involved
Once you have one party that picks greed over support, everyone has to pick greed or else they will get taken advantage of.
Problems such as xenophobia are extremely complex, but to some degree they boil down to this.
For example, just last week an afghan refugee in Austria stabbed a member of the Red Cross to death, then stole a car and stabbed the driver to death as well. People read the news, and start hating refugees, even though the specific refugees affected had nothing to do with the situation. They in turn will consider all Austrian's xenophobic and "out to get them".
Anyways, I gotta go. I'll see you all tomorrow. have a nice day!
see ya bud
@VipulNair This is literally just how human nature works. Whether you blame it on Adam or Evolution, the end result is the same. Human beings are simply not what human beings would like us to be (well, to be fair, large fractions of the world are actually okay with how we are).
I think small countries that are well educated are doing well tho
Like denmark,new Zealand,sweden
@VipulNair No. It just comes out in less-obviously-violent ways. These things are intrinsic to our nature. Being born in another country doesn't change that - just the presentation. That's why every movie/tv show about any utopia (ala Star Trek) is laughable, even while entertaining. Human nature will never allow us to really get along
i see
2 hours later…
5:29 PM
5:45 PM
@OTLT-LCar For some reason he's not pingable
I see what you did there.
@ConorMancone If someone has not been in the chat for 7 days (I think) you can't ping that person
@Conor Tom didn't see what you did there.
@TomK. Thanks, learn something new everyday!
@OTLT-LCar I didn't see what I did there :p
Wait, now I'm confused. You were serious?
5:48 PM
His name has a capital S. If you had successfully pinged him it would have been lower case
(hmmm.... maybe that's not true)
His username doesn't have a capital.
And no it isn't
(but if you had selected the auto-fill for a valid ping, it would have automatically provided the correct case)
You can't ping someone who isn't there...
Now I'm curious if the case matters - with the autofill it gives the correct case
What say you @tomk.?
did you get a ping?
It's irrelevant.
He's not present
so I can't ping him
5:52 PM
He's still generally around though. I saw him close some questions a few hours ago
1 hour later…
7:09 PM
I did get a ping. The casing doesn't matter
@OTLT-LCar and you can ping people if there are not in the chat
I assumed otherwise.
So... with my format, he should've been pinged?
but as I said, if he wasn't in chat within the last 7 days, he doesn't get pinged
Thanks for clarification.
2 hours later…
9:17 PM
@ConorMancone but they aren't intrinsic. There is no such thing as human nature. There is nurture - those brought up to think of "us" and "them" will create divisions as you describe. But more and more realise those are just stupid categories that are remediated by proper education

« first day (3233 days earlier)      last day (25 days later) »