marcinw

(I am one of the developers of Doorman). Some background, from osquery's site: "osquery allows you to easily ask questions about your Linux, Windows, and OS X infrastructure. Whether your goal is intrusion detection, infrastructure reliability, or compliance, osquery gives you the ability to empower and inform a broad set of organizations within your company."

I wrote Doorman as a way of utilizing osquery's TLS remoting endpoints, allowing me to dynamically configure an endpoint with custom queries, as well as run ad-hoc queries. We use osquery and Doorman at my company to gain visibility into our laptops in a manner many remote control based applications don't provide. Besides gaining remote administration functionality to osquery, we developed Doorman with a security-first attitude. We favor tools like osquery that don't expose remote command and control capabilities over tools like Chef or Puppet that concentrates super powers in the hands of a few people.

One of the stronger points of Doorman is it's builtin rules and alerting engine. It is one of the few security tools that I honestly can say I "set and forget" with respects to the rules we write. Want to know every time someone installs a new Chrome extension? All listening sockets on external interfaces, and the process name and user/group its owned by? New root certificate authorities added to the keychain? Done, all thanks to osquery introspection capabilities coupled with Doorman.

Proper Python would use the csv module for this operation, as your CSV export would break if `header` or `dataset[key]` contains a comma.

In addition to SQL injection, many "advanced search" engines will compile regular expression patterns from user input. Depending on the language, this can range from a simple Regex DoS to Code Execution (I'm looking at you PHP).

Java, Python, etc don't have a DOM to consider.

When you're just an XSS away from an attacker doing:

  function encrypt(plaintext) {
    $.post(plaintext, ...);
    return plaintext;
  }

then you lose. The post talks about this, and XSS isn't the only way either.

And that's your problem. I was the same way, though I live in NYC. With every pay raise I upgraded my lifestyle. Whether I was making $50k/year or $100k/year, I wasn't saving anything more besides the shit I was contributing to my 401k. My savings actually grew smaller over the years, until I made a conscious effort to save money. An effort so simple, I kick myself for not realizing it sooner.

Several simple ways I found to save money living in NYC (not SF, but close enough). Note these figures are on a per-year basis.

  - Scrap web hosting, move to AWS and S3 (~120 saved)
  - Get rid of cable, stick with cheap Internet (~1000 saved, Internet ~40/mo)
  - One night less at the bar each week (~2500 saved, that's just for a $40 tab)
  - Skip buying coffee every day (~500 saved)
  - Get a cheaper phone package (~120 saved)

In the end, I think a good rule of thumb is to keep your daily expenses under $20. You want to dress well? Wait for Banana Republic to have a 40% off everything sale, and buy clothes then. Buy clothes you're actually going to wear more than once (this is easy for guys, women have it harder).

I don't know your lifestyle or actually care what you spend money on, but complaining you can't save money is a bullshit excuse. I was bullshitting myself too, and I think everyone's got spending habits they can curb without impacting their lifestyle.

I hear people say all the time they drink a lot of water, but when you ask them to measure it out, it's a joke.

The answer to this problem is to sit at your desk with a gallon of water. You'll find you've finished at least 3/4 before the end of the day contrast to the 2-3 cups you'd usually drink.

We've solved this in the Matasano NYC office by:

* Going downstairs for coffee

* Playing a round or two of darts

When I worked in machining, we all had anti-fatigue mats at our stations. Everyone wore Red Wing boots (sneakers are terrible for you), and I heard no complaints of foot pain.

For one, a built-in theme editor that exposes you to remote command execution in the presence of another vulnerability, such as cross-site scripting (XSS).