CISO at @sardineai. Treasurer of @OWASP Board of Directors. (he/him) qatta' mIghtaHghach.
Phoenix, AZ
Joined July 2009
- Tweets 8,305
- Following 139
- Followers 776
- Likes 17,402
15-year-old scientist and inventor Gitanjali Rao is named Time's Kid of the Year (and is well deserved!).
npr.org/2020/12/03/942034617…
@Coupa - feature request: do NOT send HTML attachments for POs, invoices, or anything else. HTML attachments get blocked, which means your POs and invoices do not get received. Either provide a link, or attach a PDF, or put the HTML invoice into the body of the email. k'thx!
I missed you were updating 6265, I’ll take a look. BTW, 6265 was the product of ~35 people, including everyone from 2109. But yes, @adambarth did do the heavy lifting for 6265, including building a cookie behavior testing suite. He’s an unsung hero of the internet.
1
2
Bil Corry retweeted
Thought that we forgot about #xsleaks? Nothing could be more wrong! Today we launch an improved XS-Leaks wiki:
xsleaks.dev
The project is open-sourced and everyone is welcome to contribute. The code can be found here github.com/xsleaks/wiki.
3
110
4
296
This documentary about the USPS' 100-year-old "Operation Santa" tradition looks to be awesome.
dearsanta.movie/videos/
1
2
Beautiful story, be sure to watch the video.
abajournal.com/news/article/…
SAMM and BSIMM are two ways to assess the maturity of your AppSec program. Wonder what the difference is?
Here's a comparison:
owaspsamm.org/blog/2020/10/2…
Back when I owned the bug bounty program at PayPal, I was adamant that researchers should be able to post their findings after it was patched. That’s how the community can collectively learn.
This is even better, do it! 💪
For the exemplar of "doin' it right", see Dropbox, who leave the researchers in control: dropbox.tech/security/protec…; Dropbox does not use the bug bounty to buy silence; neither does Dropbox reserve the right to take forever to fix.
1
3
Guess I’m your dark mirror opposite. My mouse, keyboard, and headphones are all wired and I wear no tech.
1
With or without a cable, it’s unlikely I’d wear one either, but then again, I don’t wear a (smart)watch, Fitbit, or jewelry, so I’m clearly not the target audience.
1
1
I wonder if it is because it would be too heavy with a battery and Bluetooth chipset/antenna? Or the battery wouldn’t last long enough for using it for work?
Upside is less attack surface.
1
There was a similar concern about baby sign language and it too is false. So many benefits to learning additional languages as children. It’s laughable (and likely rooted in colonialism) to believe otherwise.
nbcnews.com/id/wbna8060750
In Luxembourg, the schools integrate Luxembourgish, German, and French, and at least one other language (English is popular). Their multilingualism is a source of pride and a way to open the world to their citizens.
luxembourg.public.lu/en/soci…
1
Me: I hope this 4-hour final for contract law won't take 4 hours, it's just 17 questions.
<3 hours and 46 minutes later>
Me: I finished with 14 minutes to spare!
Lesson: take your wins where you can find them...
2