@avid send me an email (rebecca@se) with concrete details for OWASP please? ie, kinda like a proposal. Lay out the specifics of costs and the benefits? Thanks.
I used to run a security consulting team for Ernst & Young, currently I run my own security consultancy, from Monday I will be building a security consultancy team for PwC.
Just recently I thought about all the solved problems in IT security, like XSS (which one can mitigate with input validation), SQL Injection (mitigated with prepared statements), etc.
Now I'm wondering, what are the biggest unsolved security problems of the year 2010? I'm wondering here if there...
yep - those answers may well be correct, but they aren't useful unless they are completed with "...and here is what we do to protect against end user problems and risks..." etc
excellent - both are invaluable. The flags force us mods to do something about the low quality stuff, and the community votes up and down are the real value in the site
I hadn't noticed this before, but the apparent bar for a security job (years of experience, degree wise, etc) at Google is lower than most of their other positions.
As some people already stated (so I'm not going to repeat that), it depends on the mechanism of brute-force attacks and dictionary attacks being used.
First of all, the best way to keep an attacker from attacking is taking away the target in the first place. None of my servers have SSH running o...
Put a lot of attention in this ans. Unfortunately it's mostly off-topic
BTW, I think we have a good deal for a future QotW
If we ever want to boost the blog frequentation :P
@JeffFerland I think that I can internally justify that. Security tends not to be one's first IT job, though that might be changing with the increase in degree programs in the field.
So it actually seems somewhat reasonable to assume that anyone with 5 years in a security position might actually have had 3-5 years in another IT job already.
For all intents and purposes, it was my first job too. That was primarily because a security analyst was one of my students during my grad program, though.
This week’s post came from this question: I just discovered major security flaws in my web store!, but covers a wider scope and includes some resources on Security Stack Exchange on defending your website. Any application you connect to the Internet will be attacked within minutes of plugging it in, so you need to look [...]
@Iszi Pretty much. Though it means I was actually able to lay in bed listening to the radio, as opposed to waiting, not understanding the news, for the weather report.
The place I work is cool enough to be worth it, and close enough to the coast (read: close enough to the hurricanes) that I wouldn't want to live nearer.
@ScottPack From my workplace, it's about a half-hour to the location that Google Earth defines as Cocoa. But my office is only about 6 miles from the actual eastern coast, as the crow flies.
@ScottPack nah - I'm right out in the country, where I can only see trees and mountains (out the back window)
don't really miss city living - although we have no pubs near us, we do have social membership to the local cricket club 2 minutes walk from the house(which means £20 a year, and drinks are 1/4 the price they are in pubs!)
@RoryAlsop Yeah, I remember looking at a shot of a house I used to live in and seeing a car I hadn't owned in some years. I think that one's been updated since.
Yup, updated.
I know the shot of my current house hasn't been taken in the past year or so. Cars are in the wrong parking spots.
@RebeccaChernoff so that's what that sharp stick is for!
@RebeccaChernoff welcome back from vacay...
@RoryAlsop heya
@RebeccaChernoff sent. I was a little wordy... but I really believe in OWASP.
actually, this would be perfect for me: there are two (professional) organizations that I really believe in, and donate a substantial chunk of my time to - OWASP and SEI.
@RoryAlsop 1/4 the price? for £20?? I'd make that back in a couple weeks.
@RoryAlsop yeah, had a guest a while ago, was eyeing my 14-year cask-strength Lagavulin - then, instead of sipping and enjoying it, he kept knocking it back, trying to finish the bottle.
we do have a good tradition in scotland - when a BBQ is planned, it goes ahead, no matter what the weather. I have had many bbq's under awnings, umbrellas...
the first time I took my wife to Orkney, newly married, I ordered a Highland Park (single malt, generally voted the best whisky in the world) and she ordered a Highland Park and coke. I think the phrase from the guy at the dartboard over the silence was "You made me miss"
a frankfurter is called a sausage here, but a frankfurter in a roll is a hot dog, and a different kid of sausage in a roll is called a "sausage in a roll"
@AviD it's a full set of design patterns. Nothing but the best food engineering practises here. Also, to confuse things, if you cook a sausage in batter, you call it toad in the hole secure.wikimedia.org/wikipedia/en/wiki/Toad_in_the_hole
oh that was brilliant - I was reading a lifehacker article, clicked on the tab to come back here and got an error.: Internet Explorer: Stackoverflow at line 17
I don't think BBQ sauce is as big a thing over here either. I certainly have never seen it used at a BBQ. I tend to marinade all the meats I bbq, but usually I'll do a piri-piri or red wine sauce
I think it's just divergence of language more than anything else. Sometimes I'll hear people refer to a lawn party that involves cooking food outside as a BBQ. However, more often than not the term bbq is used to refer to either a certain type of sauce or the smoked flesh of pork and/or brisket served with said sauce
If I click the signout link, does this mean it is not possible for someone to hijack my cookie and sign in with it?
While I'm logged in, is it possible for someone who has access to my computer's hard drive to simply grab the cookie and then signin?
Does 2-factor authentication help in any of...
XKCD.com: `This work is licensed under a Creative Commons Attribution-NonCommercial 2.5 License. This means you're free to copy and share these comics (but not to sell them). `
If I click the signout link, does this mean it is not possible for someone to hijack my cookie and sign in with it?
While I'm logged in, is it possible for someone who has access to my computer's hard drive to simply grab the cookie and then signin?
Does 2-factor authentication help in any of...
I believe a bit problem currently is password reuse.
XKCD #792 illustrates the problem with a "bit" of humour.
