chair6

We love our quirky, slow 1993 Mitsubishi JB500 campervan (https://www.instagram.com/finnthejb500/), but the experience is not for everyone. We were able to register it in Washington without too much hassle. It definitely pays to do some research and try to find a local-ish mechanic willing to work on them before you make the purchase.

Notes, photos, and maps from a few days exploring around and over Mount Ngauruhoe, Tongariro, and Ruapehu.

Nope, not missing something.. it has been a problem for GitHub (https://news.ycombinator.com/item?id=30348980) and others (https://portswigger.net/daily-swig/urlscan-io-api-unwittingl...).

https://chair6.net - occasional blog posts on various topics, powered by Pelican on an ARP Networks VPS

Mmm, Kenji's really good scrambled eggs are really good (and really quick) .. https://youtube.com/watch?v=CXTnq7srJRs.

Check out SafeStack, https://academy.safestack.io/safestack-courses/security-awar... .. they're one of the less-cringey, more-modern awareness options I've seen recently.

Just replace console.table with JSON.stringify for the quick-and-easy dump of exactly the same data as is in the table...

JSON.stringify([...document.querySelectorAll('.fatitem table .athing')].map(el => [el.textContent.trim(), el.nextSibling.textContent.trim()]).sort(([,a], [,b]) => parseInt(b) - parseInt(a)))

For a different angle on cloud infrastructure visualization, check out Abridge (https://abridge.io). I'd love to get any feedback on the idea / site and even a trial, if you're interested!

Abridge collects data across your configured set of AWS accounts & regions. It doesn't draw architecture diagrams, but instead will give you x-vs-y visualizations for a number of different relationships .. IAM users vs. groups, Lambda functions vs. runtimes, EC2 instances vs. keypair, etc.

It'll also provide inventory tables / CSV dumps of the different resource types, and simple free search across all resources.

Security-wise, Abridge collects data via cross-account trusts with the SecurityAudit role, and expires all collected data after 48 hours - more at https://abridge.io/security/.

Haha, you're predicting the .. now. GitHub Advanced Security brings in code scanning (CodeQL), secret scanning, and more.

https://github.blog/changelog/2020-05-06-github-advanced-sec...

Have spent some time with the beta, definitely worth a look.

waves, original Bandit author here. It could've done more, but pretty cool to see how useful it's been and where it's got to.. OSS is fun.

Physical products are so very different to virtual. Life is relatively easy when you can just ctrl-z, quit-without-saving, git checkout --, or redeploy. A friend has been working on this idea for the last couple of years.. it's been interesting watching him work through the process.

The game is pretty fun too!

Thanks! It's nice to get that feedback.

It's proactive, but I've been working in various security-oriented IT roles for ~15 years now, and I'm trying to take my own advice [1], so I'd hope I can do it justice. :)

[1] https://chair6.net/startups-and-security-questionnaires.html

I've been building and using https://abridge.io/ for a while now, and it's getting to the point where it is hopefully useful to others. It essentially aggregates information about AWS deployments across multiple accounts and regions into a single visualization / inventory / search interface.

Security is of course a concern - I address that in more detail at https://abridge.io/security/ but the two main parts - 1) collect data from AWS accounts via read-only cross-role access (AWS-managed SecurityAudit policy) and 2) throw all that data away every 48 hours (S3 object expiration).

It still has rough edges, but I'd greatly appreciate a) any feedback on site/content and b) signups from folks who might be interested in testing it out...

HashiCorp | Product Security Engineer | US / UK / Canada / Netherlands / Germany | FULL-TIME | REMOTE

We are looking for Product Security Engineers to help scale our product security function, which works closely with engineering & product management to ensure that security is appropriately addressed across the HashiCorp product suite.

In this role, your responsibilities will include:

* Plan & execute security assessments (dynamic testing, static testing, code review, etc) and threat modeling of HashiCorp’s products, services, and associated cloud infrastructure.

* Build and implement security solutions across the product life-cycle, such as standalone security tools, CI/CD pipeline integrations, product security features/fixes, etc.

* Monitor threats and vulnerabilities impacting HashiCorp products and services, develop proof-of-concepts as appropriate, identify mitigations and assess/communicate associated risk.

We are looking for talented self-starters with 4+ years of security experience. We will consider experienced engineers with less security-specific experience but the desire to learn!

More information and application at https://www.hashicorp.com/jobs/1664419.

Suggestion - one-click navigation from one setup to the next would be nice, instead of having to click back, reload the list, and choose another...

For more insight re. Stripe, https://fs.blog/2018/05/patrick-collison/ was an excellent Knowledge Project episode talking to CEO & co-founder Patrick Collison.