Feross Aboukhadijeh, creator of WebTorrent and founder of Socket, writes about web security, undefined behavior, and open source funding.
HN commenters link his GCC undefined behavior post as a historical example and his funding experiment recap in open source funding discussions.
Admittedly, this is a bit of an exaggerated conclusion. It is definitely possible that some subset of top CS MIT students would get anxious about coding interviews and would go to interviewing.io to hone their skills.
However, the following types of top students are significantly less likely to practice on interviewing.io, for example:
- Seniors who have already done internships at top companies (Google, FB, Stripe, etc)
- People who excelled at programming contests and generally enjoy algorithmic challenges: IOI, TopCoder, Project Euler, etc.
- People who have built awesome open-source projects that got significant recognition. For example, Feross Aboukhadijeh was a Stanford student who built Youtube Instant and immediately received an internship offer from Youtube founder Chad Hurley [1]. I doubt people like him would need to practice on interviewing.io
- In general, students who are regarded as top n% of MIT/Stanford/CMU CS are inundated with recruiting pitches (I speak from experience as a CS graduate from one of these universities. Most of us constantly received an overwhelming number of e-mails from recruiters, many of them offering to get us to get fast-tracked in the interview process).
Granted, not every top CS student at MIT/Stanford/CMU has done competitive programming or built really cool stuff that's widely recognized. But a significant percentage of the top n% of students do have this kind of background (admittedly, this is somewhat of a circular…
As we all know security through obscurity only buys you time like the article points out. Please correct me if I'm wrong but a pretty simple solution exists here. I run SSH over port 22 and do the following which I think is a pretty reasonable and safe solution (again, please correct me if I'm wrong):
1. Configure a decent firewall, edit iptables and disable anything you aren't or don't plan to use.
2. Disable root login completely.
3. Install fail2ban just in case and set it to block IPs of failed attempts for 2 to 24 hours
4. Use key based authentication and disable SSH logins using passwords altogether.
I'd recommend going a step further on number 4 and put a strong password on your key. A lot of people believe that key based authentication in and of itself is enough but if you somehow leak your keys and there's no password on them then an attacker has just easily gained access to your machine. Now I'm guilty of not using a password with my keys because like a lot of people it feels like it defeats the purpose but you can actually set things up so that you only need to enter your password once and it won't ask you for it again for a while just like the sudo "grace period" which lets you sudo without a password after you've entered it once. I do plan to give my keys a password and stop being so lazy in the very near future.
I know the Linode library as well as a few posts that have made it to the front page here explain how to do this. Here are the…
Uhm, I strongly disagree with making fullscreen https only feature.
For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps.
And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site:
http://feross.org/html5-fullscreen-api-attack/
In every browser I tried it was already obviously fake. It doesn't work already with current security tech:
1) browsers ask for fullscreen permission (with big unmissable dialogs)
2) emulated fake layout is very different from real layout (missing all per-user specific browser settings, e.g. bookmarks or extension buttons or any theme customizations, also font rendering looks different)
3) emulated fake browser UI doesn't respond to interactions in the same way as native UI
This is one of the reasons why I always join a Zoom call from my phone, by calling their international numbers [1].
Recruiters sometimes ask me to turn my video on during interviews… I politely decline and move on to other opportunities.
Their app is so privacy invasive, I cannot understand why people keep using it, specially considering 2018 vulnerability [2].
Feross Aboukhadijeh talks about Zoom security problems in Stanford’s CS253 Web Security course [3][4].
[1] https://zoom.us/zoomconference
[2] https://www.tenable.com/blog/tenable-research-advisory-zoom-unauthorized-command-execution-cve-2018-15715
[3] https://web.stanford.edu/class/cs253/
[4] https://feross.org/
A couple of my favorite technical blogs
- https://openai.com/blog/
- https://ai.googleblog.com
- http://antirez.com/
- https://research.facebook.com/blog/
- https://martin.kleppmann.com/archive.html
- https://devblogs.microsoft.com/oldnewthing
- https://www.allthingsdistributed.com/
- https://jvns.ca/
- https://www.johndcook.com/blog
- http://feross.org/
- https://ridiculousfish.com/blog/
- https://blog.andrewcantino.com/
- https://nickcraver.com/blog/
- https://blog.codinghorror.com
I have been also building an engineering blog aggregator called https://diff.blog to make it super easy to disover and follow blogs. Would love if you folks can give it a try :)
>What abuse?
phishing attacks.
https://en.wikipedia.org/wiki/Phishing
http://feross.org/html5-fullscreen-api-attack/
>I think it's a similar risk to letting people walk down the footpath.
No, that's a really shitty analogy. It's more similar to a personal location-tracking mobile device where a lot of people store private and sensitive information, on which you can access web pages and install apps that have the ability to read that information, sometimes in ways beyond what the user expects.