Matasano

~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~

MATASANO SECURITY - Chicago. New York City. Sunnyvale.

Application Security Consultant

Full-Time, work visa sponsorship available

~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~'`^`'~-,._.,-~

The security of computer systems has increasingly become an everyday concern. The news all too often brings word of yet another compromise, exposing financial information, personal details, or simply salacious pictures. Whatever the impact, it's clear the technology industry has a problem, and there are few easy solutions.

Some seek legislation to impose harsher penalties on the responsible parties. This ignores the fact that many of those responsible are outside the jurisdictions which seek to punish them. In some cases, they may have tacit approval of their own government, or even be operating on their government's behalf. Others turn to established security products looking for antivirus and network filtering technologies to add protection. This is an also an imperfect solution. It places the defender in a reactive posture, responding only to those threats which have been previously detected, and for which countermeasures have been developed. There's no perfect solutions.

At Matasano, we believe the best way to combat security weaknesses is at their source; by discovering and remediating software vulnerabilities before others leverage them for ill effect. Our clients see the value in this approach. …

Building things that people want is overrated. A person can derive great pleasure and satisfaction from ripping things apart instead. That's the gig we're offering. We work with some of the most interesting companies, along with lots of companies with interesting technology you've never heard of.

This job has had me write compilers, learn Scala, reverse and interoperate with freaky network protocols, test chipsets, write hypervisors, extend debuggers, and crawl through the heating ducts and garbage chutes of several of the biggest web apps out there. It is a very cool gig.

http://www.matasano.com

And, I have news! Since last I posted this appeal, we've opened a Bay Area office. I'm hiring in NYC. I'm hiring in Chicago. And I'm hiring in SFBay.

We're looking first and foremost for people who can code and who have a deep interest in software security. I've been thrilled with the quality of people I've gotten to talk to on HN. You can't possibly waste my time. My contact info is in my profile.

You are discriminating ... if you are hiring for a job
that requires javascript and don't hire people
who don't know it. Is that a bad thing? I dont' think so.

You might be overlooking good coworkers or employees, especially older ones who have experience in other languages. I knew zero Python or Javascript before I started this job, and now write in it 100% of the time. (My previous job was Lisp + GWT.)

Similarly, I recall an article from Matasano that said that some of their best candiates did not have prior experience with something that one might have expected to be a prerequisite: "Some of the best testers we've worked with didn't have a formal security background." [0].

If you only hire people who "know" $Language, what will you do if six months down the line you decide to rewrite in Clojure, or find that Haskell is the best way to move forward?

0: http://matasano.com/careers/

ugh, I hate this kind of post because it does exactly what I mentioned above: creates more divisions than it actually describes.

I'll just say your mention of FUD is ironic since last I checked, Mozilla's income from the google search referral contract was something like $80 million, which would make 20x that number $1.6 billion. I'd love to see your source on that one.

You also clearly didn't bother to actually read any of the report. There are in fact serious security issues brought up there, have been brought up before [1], and are an active and interesting area of research. Mozilla and the other browser vendors are actively working on the issues brought up there (for instance, [2]), which no one has solved completely.

But yes, please. Let's reduce this to soap opera and sound bites.

[1] http://www.matasano.com/research/jit/
[2] http://news.ycombinator.com/item?id=3337727

So? You guys wrote an article about it...

http://www.matasano.com/articles/javascript-cryptography/

"SJCL is great work, but you can't use it securely in a browser for all the reasons we've given in this document.

SJCL is also practically the only example of a trustworthy crypto library written in Javascript, and it's extremely young.

The authors of SJCL themselves say, "Unfortunately, this is not as great as in desktop applications because it is not feasible to completely protect against code injection, malicious servers and side-channel attacks." That last example is a killer: what they're really saying is, "we don't know enough about Javascript runtimes to know whether we can securely host cryptography on them". Again, that's painful-but-tolerable in a server-side application, where you can always call out to native code as a workaround. It's death to a browser."

I have thought about a similar service but was dissuaded by various sources warning against the idea of using javascript with cryptography, e.g. http://www.matasano.com/articles/javascript-cryptography/. That's not to say a reasonable solution cannot be found, but there are a good number of issues that need to be addressed. The one that seems crippling to me is that the strength of javascript crypto libraries is questionable at best - nevermind the various other javscript attack vectors. A browser plugin could address some issues, but then that limits users to browsers with the plugin installed. Might as well have a native application where the quality of the cryptographic algorithms are more thoroughly tested at that point. Still, I like the idea and wish you the best of luck.