jusob

Private disclosures happen well before the presentations.

Not just exercised, but bought before the company reaches $50M in assets.

Borland Delphi - My first programming language. They had a significant discount for students.

Encarta (used) - Never used it much, I got it pretty cheap. I was so impressed by the amount of information available on 1 CD

Corel Suite - Also cheap, I believe it came with WordPerfect

I got something similar: a compressed file with an ISO in it: it was a CD with autorun. I guess some OS will mount it automatically and run the autorun.inf if you double click on it.

Typo: "and support the development of tje project."

A lot of bad arguments against JWT tokens. These items are definitely something you can address with JWT token: * expiration date * invalidation * change of roles or any significant change in user attributes

Moe important, the list of issues would be the same for a session cookie: if you don't expire the session on the back-end or reflect changes in the user attributes, same issue.

Basically, apply the same best practices for session tokens or JWT token and you'll be fine. You can also put the JWT toke in the cookie, it does not have to be stored in the browser local stroage.

If you submit this job description, you would get an RFE (Request For Evidence) to explain why these skilled are requires for the job.

There are 3 ways to intercept HTTPS transparently (without a big SSL warning):

1. Put the intercepting SSL cert root in your local trusted store. This is how it is done in enterprise. The certificate is typically pushed through an MDM installed on each computer/phone. This is also how Fiddler works. This requires administrative access to your device to push the certificate root as trusted.

2. Create a rogue certificate from an existing trusted certificate registrar. This is why is a risk with nations like China where "private" SSL registars mybe forced to issue certificates for Google or other sites to the government. This was supposed to be fixed with Certificate pinning (now deprecated), and now with certificate transparency log. But the later has a few weaknesses in practice: - rarely set as enforced by the websites, or set at at all - requires each company to monitor the transparency log and get rogue certificate canceled. I don't know of any company which actually does that.

3. Interception inside the browser through an extension or plugin, or plain process hijack. Since the browser does the HTTPS encryption/decryption, an application taht runs inside the browser with the right access can see all decrypted traffic.

Except there are a lot of ways to change what is taxable in the US: 401h, HSA, FSA, etc.

It's too late, but lot of CS students do 1-2 internships, and often get a full time offer from one of these 2 offers if done 12-18 months ahead of graduation.

I've had a model 3 for 1.5 years, I've never had such issues.