nope, just noticed a flaw this morning and told them.
I have worked for the company in the past, and informed them of security problems; but my remit has never officially been security-related. Just plain development
I have been tempted by working at and interviewed for penn testing jobs, but only while my current employer was dragging their heels on getting me a proper contract.
but when I was offered a contract at my current job, it was basically "Have significantly more money, you don't have to move cities, oh and you wanted to do a Masters, right? We'll pay."
@thomaspornin re your answer on my HSM q - I don't find it satisfying. FTR, some of the points I threw in there, were kinda red herrings, but I feel like even I could write a more complete (if not as rich in information) answer.
@Adnan hang on, I'll handle that...
@Thomas sure there is a lot of good info there, but a lot of it is more like an intro to what an HSM is good for, and what it requires.
I am sure it does not cover all the key features that are worth shortlisting for. Perhaps you can add some more?
First of all thanks for the fast answer. I understand what you said, I still got one question tho: If I am the server, and I got no new revoked cert to add, why do i renew it? I basically keep it the same. Thanks again — AscaL1 min ago
While studying a security course I have been asked this very question:
Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list?
Honestly I can't find the answer, if any of you could be so kind to shed some light on it, I would be very grateful.
He did indeed have a clutch problem and found out that they were using the same clutches as he was using on his tractors, but it wasn't a complaint about them and an insult that led him to start his company, but the realization of how high their markup on the replacement was compared to what he could charge for the identical part for a tractor. He saw a great big profit margin, and that was the driving factor. It was business, not personal. :-)
What would be the recommended procedure for SSL control on a firewall for Untrusted CA's? Should you add their Root certificates and import them into the firewall or should you just whitelist the individual website that use it?
For example, 1st search result: "Because of security concerns, packets marked LSRR are frequently blocked on the Internet"... well, what security concerns?
I have the feeling copper is a bit more robust then fiber. In a datacenter this is not an issue because the cables stay where they are once the links are up.
However, in harsher conditions (temporary setups in open air, equipment hauled around the country and networks rebuilt often, ...) sturdin...
Jokes aside, I was inspired to get into security by my dad's friend. He was a brilliant locksmith, the best in the district. One time I asked him "If you can open the door without a key, can't the bad guys do the same?" he answered "That's not the point of having a lock on your door. You'll never make it impossible for the bad guy to get in, you just make it as difficult as possible".
@TerryChia Naah, it's alright. Everyone we know will die, everyone we love will die, everything we love will be taken a way. Until we remain there alone, at the moment we, ourselves, are taken and forgotten.
@TildalWave don't think so, besides the face flip, and the angle wrong, just doesnt look the same. 'Course I could be fooled by the different angles and such...
@TerryChia @LucasKauffman I kind of stepped into security gradually, but as an outgrowth of development. I liked breaking things, learning how to build them better, figure out how to break it still, and so on...
so for me it was very much the combination of the childish tendency to break things, and the engineer's compulsion with building things.
@AviD I forgot what I was searching for yesterday when I came across a mail-order asian bride ad in the top 10 image results. It had absolutely nothing to do with asians, marriage, or women.
@Jefff @Rory - I am hereby declaring a moratorium on modthinking. For the next 2 weeks, any and all flags should be immediately and promptly approved, as quickly as possible.
> When a password needs to be stored for use with a third party service, the password should be encrypted symmetrically with a key derived from the user's password.
I think I should answer that. I'm disappointed by this knee-jerk sec.se reaction “no password hashing → bad, I don't know why but I don't care, why should I look at the threat model, lalalalalala”
Security is a complex endeavor, and knee-jerk reactions like “plaintext password? never” are just as bad as “passwords must contain special characters” or “my crypto's bigger than yours” or “if I can't understand it nobody can” if you don't consider the full context.
First, let's analyze the ass...
now expecting a string of “-1 no password hashing → bad”, “TL&DR” and “+1 TL&DR”
it's only the rate limitations (comments/s, questions/day, ...) that are on sliding windows
I wish it was 280/week or something, on U&L there are many days where I want to vote on more than 40 posts and it's annoying to have to leave all these tabs open to vote the next day
do you vote on a lot of old posts? I've only cast 32 votes this week, and I'm the #3 all-time voter
@Gilles Well, it depends. But today I saw a bad answer that was upvoted.. 2 times. I was so angry, I went over every downvote-worthy answer I could see/remember and downvoted it.
@Ladadadada Well, I have a very strict mentality when it comes to the voting system. I neither go crazy with my upvotes, nor go easy with my downvotes.
When I see something bad, I have to downvote it. It's both my duty and a way to express my opinion.
@Adnan The system works on votes. The only complaint I've ever seen anyone make regarding someone else's voting habits is when they don't do enough of it.
@Ladadadada Actually I have two complains about some people's voting habits. 1- Counter-votes: Someone upvoting an answer they wouldn't usually upvote, and only because it had a downvote. 2- Being touchy feely when it comes to downvoting bad answers.
While studying a security course I have been asked this very question:
Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list?
Honestly I can't find the answer, if any of you could be so kind to shed some light on it, I would be very grateful.
