Re:LastPass RCE vulnerability fixed
by dsacco on Tuesday March 21, 2017 @03:36PM
(#13925449)
Having briefly interacted with a few of them, and following their work in general:
1. They have a phenomenal intuition for where developers get lazy, tired or simply incompetent in security-sensitive code,
2. They have, in aggregate, a vast knowledge and understanding of past vulnerabilities and how those might be repeated elsewhere or imperfectly patched,
3. They practice a lot and they read a lot (i.e. relevant research, etc). It might be more accurate to say that they have a lot of practice because of their work, not that they actively practice outside of work.
4. They are good at the general process of security research - long hours of mostly dull, complex research interspersed with brief eureka moments and bouts of euphoria.
1. They have a phenomenal intuition for where developers get lazy, tired or simply incompetent in security-sensitive code,
2. They have, in aggregate, a vast knowledge and understanding of past vulnerabilities and how those might be repeated elsewhere or imperfectly patched,
3. They practice a lot and they read a lot (i.e. relevant research, etc). It might be more accurate to say that they have a lot of practice because of their work, not that they actively practice outside of work.
4. They are good at the general process of security research - long hours of mostly dull, complex research interspersed with brief eureka moments and bouts of euphoria.
They're an extraordinary team, for sure.