lcamtuf

The article focuses exclusively on the technical side. No, certifications are not required. Sure, they will get your resume higher on the list.

Security is much more than simply breaking stuff. You need to understand the fundamentals, CIA triad, risk, misunderstandings that arise from the fundamentals, issues that generally arise with security due to the context etc. Debunk also some common myths around security. Fundamentals can land you in tables that technical skills won't. It is one thing to land bugs and another to be able to sit in a meeting with a guy from engineering and reason with his team and reach an agreement. Generally, working with non-security folks is hard and knowing the fundamentals helps. This also requires soft skills. Know your limits and be honest about them. Also, it is good to listen to people and their concerns. Generally, soft skills are super important in security because in most cases your opening statement is going to be one of the following:
- I found some bugs that I want to discuss with you.
- You did X which violated that policy and it rang an alarm in SOC.
- We have this issue and I came up with this plan to build this to address it.
Being able to calm the other side is crucial or you risk derailing the conversation. Also, being able to write code helps a lot. As a matter of fact, I forced team-members to work for other teams for two months. Not only they brought skills back, my team now had an understanding of their work and potential…

"CVE counting" is not necessarily a good proxy for "security". The practice of drawing conclusions from various CVE statistics has been variously debunked over the years. I strongly recommend reading this 6-year old(!) resource from @lcamtuf:

https://lcamtuf.blogspot.com/2010/05/vulnerability-databases-and-pie-charts.html

My own personal favorite anecdotes of why CVE counting is fail:

1) Adobe used to tour around presenting a chart of how their CVEs were decreasing over time. But then @taviso did a bit of simple fuzzing and found almost 100 issues. So it turns out the Adobe CVE count was low simply because no-one was looking hard. In fact, Adobe assigned a single CVE to all the issues, in this waffling blog post:
http://blogs.adobe.com/security/2011/08/how-did-you-get-to-that-number.html

2) Google Chrome has lots of CVEs because of the monetary incentives to go and find and report them. A quick comparison of CVEs for Chrome vs. some browser without a decent rewards program might lead you to incorrect conclusions.

3) Historically, Microsoft did not publicly disclosure or assign CVEs for issues found internally by employees. This contrasts with Chrome and Firefox, which have a greater culture of openness, where internal security discoveries are documented publicly. Quasi-arbitrary decisions like this bend the numbers all over the place, from vendor to vendor and product to product.

You've already lost me by step two; I have no clue what "force is the negative gradient of potential" means or what a "conservation force field" is. When my non-expert perception is that potential energy already seems a bit like a hack to cause conservation to work, citing some technical fact based on the assumption that there's something called "potential" with a negative gradient that I should take for granted as equivalent to force doesn't really do much to dispel that. It seems like your response is assuming I understand a lot more than I do, and I suspect that if I understood enough to do anything other than just trust it at face value, I probably wouldn't need any explanation about why my intuition is wrong in the first place!

Circling back to the blog post here, it seems like the author is specifically trying to discuss things in a way that non-experts can still follow along with I took a lot at a couple of other posts on the blog after finishing this one, and the one about a "proof" that pi equals 4 had a section that felt pretty similar to me, where it cites an explanation of why it's wrong conveyed in as way that probably doesn't do much to help the people who are most likely to need it in understanding why the proof is wrong: https://lcamtuf.substack.com/p/4

The problem they’re worried about is untrustworthy browser extensions that have broad permissions to do harm. There are over 100,000 extensions and from a security standpoint, not having good-enough sandboxing is a vulnerability.

More: https://lcamtuf.substack.com/p/the-asymmetry-of-nudges

> In reality, Manifest V3 was meant to solve a real problem — and to do so for the right reasons. I know this because about eight years ago, we set out to conduct a survey of the privacy practices of popular browsers extensions. We were appalled by what we uncovered. From antivirus to “privacy” tools, a considerable number of extensions hoovered up data for no discernible reason. Some went as far as sending all the URLs visited by the user — including encrypted traffic — to endpoints served over plain text. Even for well-behaved extensions, their popularity, coupled with excessive permissions, opened the doors for abuse. The compromise of a single consumer account could have given the bad guys access to the digital lives of untold millions of users — exposing their banking, email, and more.

Maybe they could have avoided controversy by grandfathering in a few popular extensions and watching them closely?

The classic article is by George Monbiot at The Guardian 24 Oct 2011

https://www.theguardian.com/commentisfree/2011/oct/24/advertising-poison-hooked

Advertising is a poison that demeans even love – and we're hooked on it

With AI everywhere, the trust level gets even lower

https://lcamtuf.substack.com/p/psa-ebay-lets-chatgpt-make-up-item

PSA: eBay lets ChatGPT make up item descriptions

And Chrome is playing its chrome games.

That is to say, sites can ask Chrome directly what kinds of topics you're interested in – topics automatically selected by Chrome from your browsing history – so that ads personalized to your activities can be served. This is supposed to be better than being tracked via third-party cookies, support for which is being phased out. There are other aspects to the sandbox that we'll get to.

https://www.theregister.com/2023/09/07/google_privacy_sandbox/

Discussion: https://news.ycombinator.com/item?id=37427227

If you followed some common-sense advice [1], you only needed two patches: the original one as a stop-gap measure for the original RCE on September 24, and Florian's prefix-adding patch that came out shortly thereafter (but has taken some time to appear upstream).

Now, I'm a bit stumped how any obvious variant of the CVE-2014-6271 or CVE-2014-6278 RCE payloads could lead to accidental code execution somewhere else, since they generally produce a parser-breaking syntax error when executed outside an env-encoded function definition. Also, because of an unusual fixed-string prefix required to carry out the attack, there is not a lot you can really do to avoid any half-baked IDS/IPS. Anyway, for the sake of my idle curiosity, I secretly hope that Alex shares the buggy line of code, even though that's unlikely =)

[1] http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html