Twitter names famed hacker 'Mudge' as head of security

Re:Twitter names famed hacker 'Mudge' as head of security by bawolff on Tuesday November 17, 2020 @04:01AM (#25121504)

The core doesn't really move that fast. 90% of everything is still an injection vulnerability of one form or another, and if you go above the level of vulns, most organizations are really looking for people to do risk analysis, in which case, the actual vulns somewhat become less central (however there are lots of different types of security engineers, and lots of them have very different responsibilities)

It depends a lot on what you're doing of course. I do web application security stuff (glorified xss detector), i've personally felt that the most useful tools by far are the browser dev console and curl, but ymmv.

> I didn't meant that, sorry if I made it sound as if I expected people to solve CTF tasks during SE interviews

>Just wanted to encourage people to do cool stuff :)

Oh i definitely agree, ctfs can be a lot of fun.

[ Parent | on HN ]

Re:Twitter names famed hacker 'Mudge' as head of security by twox2 on Tuesday November 17, 2020 @10:23AM (#25124775)

At the end of the day most compromises that aren't state sponsored happen using low-tech methods like sim-swapping and spear phishing.

[ Parent | on HN ]

Re:Twitter names famed hacker 'Mudge' as head of security by bawolff on Tuesday November 17, 2020 @02:06PM (#25128149)

Honestly, that's the high tech end of what happens.

Most compromises are credential stuffing.

[ Parent | on HN ]

Re:Twitter names famed hacker 'Mudge' as head of security by twox2 on Wednesday November 18, 2020 @01:12PM (#25140175)

Yeah, for sure. It's bizarre that it's not standard practice to just blocklist previously used credentials from already documented leaks.

[ Parent | on HN ]