Readit News logoReadit News
0x53 commented on FBI Director Waived Polygraph Security Screening for Three Senior Staff   propublica.org/article/fb... · Posted by u/Jimmc414
tucnak · a month ago
This is not accurate.

Polygraphs are not detecting lies, they're used to assess your sensitivities; there are really talented interrogators in counterintelligence, whose full-time job is to fuck with you in subtle ways. To poly a person at will is very much a power move, and some guys fucking love it. But that's a different story all together. Most of the time it's a formality like everything else. In reality, people don't have remotely enough bandwidth to pursue stuff like that unless there's a genuine investigation. But office politics people will office-politique.

Unpopular opinion: private companies should poly people more often in hiring, it could prove more useful than other arbitrary kind of culture fit interviews. Food for thought.

0x53 · a month ago
Thankfully, it is illegal for private companies to do that.
0x53 commented on Show HN: Patio – Rent tools, learn DIY, reduce waste   patio.so... · Posted by u/GouacheApp
0x53 · 7 months ago
Love the idea and hope you are successful. I really think there is a lot of value to be unlocked in sharing/renting tools. In my area we have a tool library which is handy.

Some ideas: - I would focus a lot of effort on making it incredibly easy and intuitive to list things. This is one of the primary barriers to me when using these types of apps. - maybe future idea would be to list things from Home Depot or other stores to expand the number of rentals that are available.

0x53 commented on Show HN: JuryNow – Get an anonymous instant verdict from 12 real people   jurynow.app/... · Posted by u/sarah-brussels
0x53 · 8 months ago
Cool idea. Not sure exactly, but when it went to the jury duty section I just got the same question a bunch of times.
0x53 commented on Scott Galloway: How the US is destroying young people's future [video]   ted.com/talks/scott_gallo... · Posted by u/Anon84
0x53 · 2 years ago
Been a fan of Scott’s for awhile. Don’t agree about everything but I think this video calls out the most important systemic problems.
0x53 commented on BlackCat ransomware group implodes after apparent payment by Change Healthcare   krebsonsecurity.com/2024/... · Posted by u/todsacerdoti
0x53 · 2 years ago
I should be against the law to pay a ransom for data.
0x53 commented on Contra Wirecutter on the IKEA air purifier (2022)   dynomight.net/ikea-purifi... · Posted by u/drdeca
0x53 · 2 years ago
My wire cutter disagreement is their flashlight recommendation. They recommend a AA battery flashlight from Amazon that in my opinion is terrible (https://www.nytimes.com/wirecutter/reviews/best-flashlight/). This article indicates that maybe the referral money is a factor. I wonder how much influence that has.
0x53 commented on Beg Bounties (2021)   troyhunt.com/beg-bounties... · Posted by u/eiiot
0x53 · 2 years ago
I guess I wonder about the opposite side of this. While I hate the beg bounty people as well, I don't think security researchers should work for free. I have found several security vulnerabilities that I have never reported to the company because their security policy was basically "send us everything you found for free and we won't give you any credit".
0x53 commented on MGM Seeks Contractors to Repair Infra in 3 Weeks   snagajob.com/jobs/8706147... · Posted by u/whoitwas
pphysch · 2 years ago
Reputation is vital in the extortion world. There has to be some trust that if you pay a ransom, the other party will follow through.
0x53 · 2 years ago
That makes sense. I feel like a federal government policy making it illegal to pay a ransom would go a long way towards making this type of thing less profitable.
0x53 commented on The WebP 0day   blog.isosceles.com/the-we... · Posted by u/benhawkes
anyfoo · 2 years ago
This again.

Strong type systems can give provably correct code. For trusted code (e.g. not third party code), sandboxing is a post-exploit mitigation. And such a post-exploit mitigation cannot necessarily guard against any class of bugs that (at least in some aspect) provably correct code can.

Yes, of course privilege separation as much as possible is still extremely valuable, but to say that sandboxing is a "better" solution, implying that one should not pursue provable correct code in favor of post-exploit mitigation, is a harsh liability. It's the same as the "oh, we don't need to use a type safe language, we have unit tests"-crowd, only worse.

0x53 · 2 years ago
What does provably correct mean here? I think you mean that the code doesn’t have any memory corruption vulnerabilities. However, that is only one class of vulnerability, so more techniques then just relying on a memory safe language are required for secure software.
0x53 commented on The WebP 0day   blog.isosceles.com/the-we... · Posted by u/benhawkes
kristopolous · 2 years ago
Can you give me a real number on that? Are we talking over a million? Over 5?
0x53 · 2 years ago
The only publicly posted price list that I know of is zerodium’s (evil people). http://zerodium.com/program.html They currently offer 2.5 million for an android zero click with persistence. This doesn’t give you the persistence piece without another bug so maybe 2m. Of course, they are only willing to offer that price if they could sell it for much more.

u/0x53

KarmaCake day486November 4, 2020View Original