@daya Weechat is nice, definitely one of the better clients. I use irssi personally (it's similar to weechat but a little simpler and more minimalistic). You managed to get on #twit on STS? Lots of great people to follow there (or just read scroll logs).

@J.J Nice!

cloud.google.com/blog/products/gcp/…

This is interesting.

> Reduced attack surface area: Google has helped to improve KVM security by removing unused components (e.g., a legacy mouse driver and interrupt controllers) and limiting the set of emulated instructions. This presents a reduced attack and patch surface area for potential adversaries to exploit. We also modify the remaining components for enhanced security.

This is something that's been on my todo list for experimenting for a long time, specifically limiting the amount of instructions that are emulated (esp MSRs).

Though to be honest, while the PIC/PIT (i8254/i8259) could certainly be emulated in userspace, they aren't that complex. APIC probably should go to userspace though...

Hm, I wonder if there could be a slight security improvement by turning ASSERT() into BUG_ON() so it doesn't get optimized out by the compiler?

#define ASSERT(x) BUG_ON(!(x))

elixir.bootlin.com/linux/latest/source/arch/x86/kvm/vmx.c#L9363

A possible interesting target for hardening (or exploitation).

elixir.bootlin.com/linux/latest/source/arch/x86/kvm/x86.c#L1046

Emulated MSRs.

elixir.bootlin.com/linux/latest/source/arch/x86/kvm/x86.c#L5735

Generic emulated operations.

@J.J I didn't pick up any swag, unfortunately, but I got a good chat with the two vendors I need to talk to, and a good dinner with a couple of the old hands on Sec.SE

> We explore one such variant, SPLITSPECTRE, in depth and demonstrate its applicability to a real-world scenario with the SpiderMonkey JavaScript engine. Further, we introduce SPECULATOR, a novel tool to investigate speculative execution behavior critical to these new microarchitectural attacks. We also present our findings on multiple CPU platforms.

@J.J I only was there for a couple of hours. Free ticket too - as I only found out this week that I could get there

damn..

possible HNQ detected: security.stackexchange.com/questions/199226/…

I fail to see the comedy in that <:

because you hit the exact number?

@J.J yeah, I also have some questions/answers that already have a lot of upvotes that still gain me rep over time

if you look at the top users per month you will almost always see one of the bears there, because they still gain rep through their many great answers

definitely

most people are

if you want I can take a look at it and give you some pointers

you don't need to compare yourself to Bruce Schneier or Jann Horn

you need to compare yourself to an 18year old who knows nothing about IT

and personal interests are great in a CV/motivational letter

most people leave work and think about their hobbies, their families and a lot of other stuff

to show that you are invested in what you are doing is really cool

as I said: everybody is bad at this. especially IT folks

I reviewed applications a few weeks ago and most of them were horrible

yeah, supercringe

good :P

if you have something like "youngest network engineer that completed XYZ" put it in there

but I wouldn't do much more than that

but that's probably a claim that is hard to prove

but you could probably say "... completed XYZ in my company/school/whatever"

mentioning it once doesn't make you look like a prick IMHO. mentioning it three times does :P

I wouldn't add the "fulfill my dream" thing. You should talk about why you want to do something. Why are you motivated or what did motivate you to switch from network engineering to security?

yeah, that does nothing and every half skilled person in a management position sees through that

then think about it

sit down with a piece of paper, put your phone in a drawer and think think about it

you know what I mean

alright

can you show me?

not necessarily

Junior Vulnerability Analyst?

uh: Last application date: 25/1/2019

okay, whatever

there will be new ones

the market is so thirsty for people right now

anyway: what matters in a CV is clarity

nobody gives a flying fck about your A grades or your pets name or buzzwords

what matters is: what are your qualifications, what are you able to do

and what do you want to do

nobody wants to hire someone that applies for random jobs or that is unsure whether he/she actually wants to do the job

you want highly motivated people that can do what they say they can

so you have to prove what you say you can: your CCNA is good for that, saying you work on your OSCP is also good, saying you participate in CTFs and in sec.se in your freetime is also great

and you have to substantiate why you want their job in a brief manner

cool

but mention the CTFs anyway, because I only check GitHubs if I'm unsure about a person

only if it is well maintained

then don't

if you maintained it well for a year, start using it

cool

I think the latter will do

I hate scrolling through tons of certificates

our applicants sent us scans from their certificates that were 20+ years old

m(

glassdoor.com/blog/guide/how-to-write-a-cover-letter :P

this is where your motivation should be explained

@TomK. I reckon it would be closed as too broad. Every company does things differently

@J.J when I was that age my CV was 2 sides of a piece of paper. A bit on my academic results (showing I could learn) a bit on my sporting results (interest, hobby, skill), a bit on my role teaching sailing (leadership, risk management), a bit on my computers (IT interest, techy skills) and a bit on where I had lived (some weird parts of the world - conversation starter)

That was pretty much it

@RoryAlsop alrighty