dkopi
Joined 12 years ago
Joined 12 years ago
It isn't about believing your government is moral or good. Its about understanding that your government is responsible for the safety of citizens, and that your enemies will want to kill you (or at least kill your soldiers).
Export controls are there to prevent killing machines getting in the hands of a countries enemies (or potential enemies in the future)
The government shouldn't be forced to buy any type of military technology someone creates. But even if the government won't buy your tech, it still can be dangerous in the hands of other countries.
One could argue that if the government is preventing you from selling your tech abroad - there should be some sort of compensation for this. Others could argue that's just the cost of being in the business of weapons manufacturing.
While its always great for your career to be in a company that's constantly growing - sometimes being that person that can help the company do a lot more with less resources is even better for your career. When everyone's jumping ship - the people who choose to stay on-board can often be very rewarded as far as their career growth goes.
If a service has an outage and a company posts a postmortem, we all think: "wow! that was an interesting bug, lets learn from this". We shouldn't be treating security issues differently.
People who make security mistakes aren't idiots. They aren't negligent. They're engineers just like us, who have tight deadlines, blindspots and mistakes. Shaming people and companies for security bugs will only cause less transparency and less sharing of information - making us all less secure.
This is a really cool bug. Kudos to the researcher for finding it, responsibly reporting it, and to paypal for fixing it in a timely fashion. Hopefully - this type of bug changes some internal processes and the way the company thinks about 2FA.
As for security questions - these are obviously insecure, and should really never be relied on. If you can opt out of security questions - do so. If you can't - just generate a random password as the answer. "I_ty/:QWuCllV?'6ILs`O12kl;d0-`1" is an excellent name for your first dog / high school. Just don't forget to use a password manager to store these.
if ((isset($_POST["SecurityQuestion0"]) && $_POST["SecurityQuestion0"] != $answer0) ||
(isset($_POST["SecurityQuestion1"]) && $_POST["SecurityQuestion1"] != $answer1)