@ConorMancone Why though? They made their reasons pretty clear
It breaks some (although badly designed) websites, it can be circumvented with relative ease, it requires a lot of attention from the devs and there are much better ways (e.g. CSP) to do it right.
I personally am very happy to see it gone.
@ConorMancone And regarding that chrome:// question. Why on earth would anyone think that it works like that?
@MechMK1 Then it probably would have helped if I had read their reasons :) I've kept up with some of the challenges the XSS auditor faced over the years, but hadn't realized they had risen to the level where it was better off not existing
I think the primary reasons for it to cease existing was that it was not effective at what it was supposed to do, and that it supposedly even introduced new security flaws
From an architecture point of view it's understandable. It's another moving part, that doesn't move well, is really redundant and just serves no purpose
Sadly I will not be joining you guys as official members of the security community (aka I got turned down for the application security engineer job I applied for)
It's okay. It's a transition I want to make, but it will just take some time. I'm not hard-up for a job, so worse things have happened
I've been playing around with the idea of getting a certificate or two. I might do that, and also try to more proactively use my job to practice some additional skills
A big part of the job was performing threat modeling with the engineering teams before they started their sprints, and I've never done an actual threat modeling session before. As a result I knew I wasn't a slam dunk
I started doing it a bit as a part of my attempt to move more directly into the security gig. I have learned quite a bit doing it, although I only submitted one bug report.
Provide clear proof of concept, try to clearly explain cost of breach, but at the end of day if management doesn't want to fix it, it is there money on the line, so :shrug:
Yes, basically any vulnerability the company becomes aware of immediately becomes a "risk"
And the company has to decide how to handle that risk. Sometimes "doing nothing" is the right choice, e.g. if the likelihood and severity are very low, and the cost-to-fix would be too high by comparison
But my key takeaway point should be "Make sure someone is responsible for it and understands what the actual risk is"
It would still be work, and the risk owner has to decide how likely it is that this risk becomes a concrete problem, and how much impact it would have.
I completely understand devs of some system just being like "We'll just autoincrement user id's" because that's what I would do too
I've been using my boyfriend's phone for a few months I never use Bluetooth cos I don't know what it is or what it does. Today he borrowed my phone to go on Facebook later on I noticed the Bluetooth symbol was on the top of my phone I swiped down and pressed on blue tooth and under the symbol the...
It's not meant to address you, just these kinds of people.
I always see questions like "I checked my boyfriend's phone and saw something I don't understand. <Is he cheating on me?>"
The last part is often implied, but it's there in their heads
It just makes me so sad. If you can't trust your partner and feel like you have to go to a set of random strangers with little more than a hunch of what may be happening, then you seriously need to reconsider your relationship.
I've seen some here. I remember one woman saying that her boyfriend told her he was in "that city" but his IP address showed a nearby bigger city and she's worried he's cheating on her.
I am so far away from a healthy relationship. I am slowly going to the point where I ask myself if being alone wouldn't be better for my mental health.
I wanted a relationship where me and my partner could depend on each other. What I got was a relationship where my partner depends entirely on me and I can't depend on her.
It is essentially like living with a teenager, even though she's 21.
Those are hard situations to get yourself out of, whether that is through your partner becoming a more functional person, or simply figuring out how to extract yourself. It's tough, and having a stressful home is definitely no fun
According to my understanding a hacker has two options to spy on someone. He can trick the user into installing the spyware himself or if that doesn't work he has to find a service that the target is using which has vulnerabilities that he can exploit. If he finds a vulnerability that allows him...
I've been using my boyfriend's phone for a few months I never use Bluetooth cos I don't know what it is or what it does. Today he borrowed my phone to go on Facebook later on I noticed the Bluetooth symbol was on the top of my phone I swiped down and pressed on blue tooth and under the symbol the...
Emoji use doesn't bug me as much (when used sparingly), mainly because tone is so hard to read over text, and a smiley/grumpy/frowny face avoids a lot of confusion
@ConorMancone It's hilarious, because I have the exact opposite problem with them, namely that modern emoji usage is so ambiguous
It's almost as if the English language has words that can be used to concisely express a wide range of thoughts and emotions, if one were only willing to invest more than a moment into writing something.
My all-time favorite meeting story ever was at a place that manufactured body armor, gun holsters, etc... Totally looked around the room at least once to see people pull guns out of holsters and start playing with them (usually checking the fit of a new gun holster). You don't normally expect to see people waving around pistols in a business meeting...
The big day came, and then there was the alarm. Everybody was like "Ah yes, I remember", except that girl. She FREAKED THE FUCK OUT! Like literal life-and-death panic.
First she screamed, then jumped out of the window (we were on the ground floor so it wasn't a big deal) and then ran away screaming
Apparently she ran all the way to her grandparents on the other side of the village
The eggplant is considered one of the most used emoji for precisely this reason. Close follow-up is 🍑
I'm sure you can guess what that is supposed to symbolize
Another problem I see with emoji is that they aim to represent "anything". Abstract places (the office), specific places (the Tokyo tower), all kinds of food, emotions, professions, activities, etc...
This inevitably leads to "This thing has an emoji, why not that thing?"
"The Unicode consortium considers X less important than Y because X has no emoji while Y has one"
It completely neglects the idea of Unicode, to represent every glyph used in any writing system by humanity.
by assigning emoji to all things, we essentially have to emojify everything
Because China has money, and because everyone needs China. That's why they can get away with everything.
Because your phone is made in china, your clothes are made in china, your TV is made in china, etc...
And you may say, "No, that's not made in china. That's made in somewhere that's not china", and that may be true on the surface, but the components were made in china.
We let them do whatever they want, in exchange for money and products.
Imagine five groups, all living together. People naturally want to support their own group, but they have no problem helping people from other groups.
All people in those five groups share the same ressources, be it jobs, land, actual resources like water or food, etc...
Imagine, one group thought to themselves that they could be better off if they would not support the other groups anymore.
They would still be supported by others, but not give back anymore. At some point, that group would cause problems in the system. Other groups would either stop supporting that group, or start becoming selfish as well.
The problem is that "being selfish" has more net-gain than being supportive. As a result, everyone wants to be selfish.
If all 5 groups are selfish, everybody loses, because every group has some surplus (that they can't get rid of) and some deficit (that they can't satisfy)
Yes it is, hence the lesson that supporting each other requires good-will from all parties involved
Once you have one party that picks greed over support, everyone has to pick greed or else they will get taken advantage of.
Problems such as xenophobia are extremely complex, but to some degree they boil down to this.
For example, just last week an afghan refugee in Austria stabbed a member of the Red Cross to death, then stole a car and stabbed the driver to death as well. People read the news, and start hating refugees, even though the specific refugees affected had nothing to do with the situation. They in turn will consider all Austrian's xenophobic and "out to get them".
Anyways, I gotta go. I'll see you all tomorrow. have a nice day!
@VipulNair This is literally just how human nature works. Whether you blame it on Adam or Evolution, the end result is the same. Human beings are simply not what human beings would like us to be (well, to be fair, large fractions of the world are actually okay with how we are).
@VipulNair No. It just comes out in less-obviously-violent ways. These things are intrinsic to our nature. Being born in another country doesn't change that - just the presentation. That's why every movie/tv show about any utopia (ala Star Trek) is laughable, even while entertaining. Human nature will never allow us to really get along
@ConorMancone but they aren't intrinsic. There is no such thing as human nature. There is nurture - those brought up to think of "us" and "them" will create divisions as you describe. But more and more realise those are just stupid categories that are remediated by proper education