News for hackers. Stuff that matters.

codepoet

Re:The Bogus CVE Problem on Friday September 22, 2023 @11:35AM (#37613414)
It's not only that the CVE database / process is broken, but via EO 14028 in the U.S. and CRA in Europe transparency is mandated via SBOMs. While I believe this transparency is good, it can be abused to enforce compliance-driven security: Fix all critical, high and medium CVEs within well defined time frames. PCI DSS and many other standards kind of encourage that view already today. It will then just be measurable by outside parties, which then means the limited security budget will be used to "fix" things that don't matter as much.

And I agree with you, Lars: We should be using CISA's KEV, First's EPSS and other means. But I'm not sure software customers would accept seemingly higher risk (high number of unfixed critical / high CVEs), even if the EPSS suggests overall much lower risk.

I've written in longer form at [1] about this issue.

[1] https://florian.noeding.com/2023/08/29/sofware-bill-of-mater...

Re:Ask HN: Who is hiring? (June 2023) on Thursday June 01, 2023 @07:04PM (#36158653)
Adobe | Product Security Engineer | San Jose or Remote USA | $129k-$235k salary + RSUs + Bonus

Are you interested in creating Security As Code content that has the potential to reach thousands of developers? We are hiring for a product security engineer that is familiar with writing custom rules for an automated code review platform that includes Static Application Security Testing (SAST) and Software Composition Analysis (SCA) scanners. If you enjoy creating developer delight while also helping to increase the overall Securability of Adobe products you might be a great fit for our team.

You can apply at https://adobe.wd5.myworkdayjobs.com/external_experienced/job...

Re:How a CPU works: Bare metal C on my RISC-V toy CPU on Friday January 27, 2023 @12:01AM (#34542673)
The idea with multi-cycle memory was to create a special challenge for myself. Also I thought about using the same technique would be useful if I later on wanted to have mul / div in hardware, which would take a couple of cycles too.
Re:How a CPU works: Bare metal C on my RISC-V toy CPU on Thursday January 26, 2023 @11:58PM (#34542660)
yes, these are great!
Re:How a CPU works: Bare metal C on my RISC-V toy CPU on Thursday January 26, 2023 @11:54PM (#34542617)
You are right :)

Here's the repo: https://github.com/fnoeding/fpga-experiments

I'll update the post with it too.

Re:How a CPU works: Bare metal C on my RISC-V toy CPU on Thursday January 26, 2023 @07:44PM (#34541034)
thank you, fixed.
Re:How a CPU works: Bare metal C on my RISC-V toy CPU on Thursday January 26, 2023 @07:42PM (#34541020)
thank you!
Re:How a CPU works: Bare metal C on my RISC-V toy CPU on Thursday January 26, 2023 @07:41PM (#34541007)
Thank you!

I'll think about sharing the code. Large code parts - while working - did not pass my quality bar, since I did not have enough time to clean and refactor while learning. But maybe that's fine. Hmm.

Re:How a CPU works: Bare metal C on my RISC-V toy CPU on Thursday January 26, 2023 @11:21AM (#34533753)
I always wanted to understand how a CPU works, how it transitions from one instruction to the next and makes a computer work. So I thought: let's implement one and run a C program on it.
Re:How useful is a Physics degree? on Saturday April 28, 2012 @06:10PM (#3904276)
Sounds very familiar ;)

I have an econophysics degree, work in IT and can easily compete with CS graduates. Started my first job as a software developer and now I'm the head of my own development team and also responsible for hiring.

As a physicist you are a problem solver: You will learn how to learn, how to tackle complex challenges in a systematic way and analyze experiments. These skills are very useful. If your physics and math knowledge helps you later on depends on your future job. My own work does not involve physics, nor any non-trivial math.

The biggest hurdle will be getting your first job in IT: You have to show that you are as capable as a CS graduate. That's easier if you apply for jobs that don't focus on algorithms, for example systems programming. Though some companies will only hire CS graduates and miss the chance to get cross-domain knowledge...

So how to show the hiring manager that you are good at writing software? Write (open source) software, mention projects on your CV and also in your cover letter. I love to see links to github / bitbucket on a CV.

If you have passion for writing software, are willing to invest a huge amount of time and you know how to teach yourself then you can be become a great software developer.

Re:Ask HN: Who is Hiring? (January 2012) on Monday January 02, 2012 @07:24AM (#3415693)
gateProtect, Hamburg, Germany FULLTIME, working permit required, only on-site

http://gateprotect.com/en-GB/company/jobs.html

gateProtect is a company providing security solutions focused on unified threat management (all-in-one firewalls).

Backend Software Engineer: Help us write the control application of a network security device using Clojure. You are an excellent software developer and know many different paradigms from object oriented to functional and used your knowledge to create complex systems in many different languages like C++, Haskell or a Lisp dialect. Prior knowledge of Clojure is not required if you know another Lisp dialect. You also know the details of low lewel systems programming under Linux.

Backend Software Test Engineer: Write automated tests that check if the production code is working using Python. A strong understanding of network protocols, related tools and Linux is more important than excellent programming skills.

Please contact [email protected] for more details and mention Hacker News.

Re:Ask HN: who's hiring for Clojure? on Saturday December 03, 2011 @06:00AM (#3307483)
you will find some offers in this thread: https://news.ycombinator.com/item?id=3300290
Re:Ask HN: Who is Hiring? (December 2011) on Thursday December 01, 2011 @01:21PM (#3300774)
gateProtect, Hamburg, Germany FULLTIME, working permit required, only on-site

http://gateprotect.com/en-GB/company/jobs.html

gateProtect is a company providing security solutions focused on unified threat management (all-in-one firewalls).

Backend Software Engineer: Help us write the control application of a network security device using Clojure. You are an excellent software developer and know many different paradigms from object oriented to functional and used your knowledge to create complex systems in many different languages like C++, Haskell or a Lisp dialect. Prior knowledge of Clojure is not required if you know another Lisp dialect. You also know the details of low lewel systems programming under Linux.

Backend Software Test Engineer: Write automated tests that check if the production code is working using Python. A strong understanding of network protocols, related tools and Linux is more important than excellent programming skills.

Please contact [email protected] for more details and mention Hacker News.

Great! Maybe you could compare this with http://www.ntop.org/PF_RING.html for Linux?
Re:Ask HN: What Card/Board Games Are You Playing? on Tuesday July 13, 2010 @02:29PM (#1512290)
Puerto Rico and Powergrid are my favorites. Some other great games: Dominion, Cosmic Encounter, Space Alert, Risk

Also take a look at: http://boardgamegeek.com

Re:Htop - better top on Friday April 16, 2010 @11:22AM (#1270847)
ltrace
Re:Htop - better top on Friday April 16, 2010 @07:56AM (#1270327)
iftop, mtr
Re:Ask HN: Writing an 80App on Wednesday November 18, 2009 @07:28PM (#949469)
That's probably not the primary reason to use 80legs - but avoiding to implement a whole crawler.
Re:Ask HN: Writing an 80App on Tuesday November 17, 2009 @06:53PM (#947494)
http://news.ycombinator.com/item?id=840244

Crawling "only" 120k pages can be done easily with a pure Python solution over a normal home / office internet connection. The packages urllib, urllib2, robotexclusionrulesparser and lxml are a good start.

Important: Don't forget to implement a crawl rate limit.