sirwolfgang
Joined 13 years ago
Karma
142
Submissions
52
Member since
Sep 10
[ my public key: https://keybase.io/sirwolfgang; my proof: https://keybase.io/sirwolfgang/sigs/ctPZ77mw6n5gUbOI8wOygYoTYaV7ooi7_GaeXCiIzHc ]
View on Hacker NewsRecent submissions
Comment · 10 years ago
- Focus on solving problems not writing code. Many problems can be solved with a communication, long before you need to write a line of code.
Comment · 10 years ago
I always thought this was the more nuanced but clever part of the operation.
That said, I would hate to have been one of the test pilots for the barrels. One of them bounced too high, and ripped the plane in half.
Comment · 10 years ago
The main one in the article:
http://www.cs.berkeley.edu/~jnear/space/
"SPACE is a specification-free tool for finding missing security checks in Ruby on Rails web applications using a catalog of access control patterns in which each pattern models a common access control use case. SPACE checks that for every kind of data exposure allowed by an application's code, some security pattern in our catalog also allows the exposure. The user provides a mapping from application types to the types of our catalog, and then SPACE identifies security bugs automatically."
The paper referenced:
https://dspace.mit.edu/bitstream/handle/1721.1/99841/9274107...
Comment · 11 years ago
[I not saying I am an expert] It is always a problem to expose passwords. Sure they can't use it from the outside, but what's the point of even having the password if its public? The password is to prevent unauthorized access. If they are able to get to a box, and pivots, that password becomes useful to the attacker.
Comment · 11 years ago
I am also here to answer any questions anyone might have.
Comment · 11 years ago
I mean, that pretty much is the entire premise of C++. Which notably does have a full wrapped string class.
Comment · 11 years ago
For anyone interested, in the very hacked together way, here is the code: https://github.com/sirwolfgang/unix-tweet
Basically, we send out N number of tweets at the same second by queuing up and spin locking the workers. The real trick is getting all the connection pooling so that you don't blow your connect limits on everything.