gavingmiller

It’s a good callout, shouldn’t have editorialized like that.

Not even close to the point I was making: If you want to get taken seriously, write to audience.

The piece the author is missing, and why zendesk likely ignored this is impact, and it's something I continually see submissions lacking. As a researcher, if you can't demonstrate impact of your vulnerability, then it looks like just another bug. A public program like zendesk is going to be swamped with reports, and they're using hackerone triagers to augment that volume. The triage system reads through a lot of reports - without clear impact, lots of vulnerabilities look like "just another bug". Notice that Zendesk took notice once mondev was able to escalate to an ATO[1]. That's impact, and that gets noticed!

[1] https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b...

zendesk is 6k employees, they have general council on staff

3 is hardly a sea shanty of vulnerabilities for a 7 year old library. I think you're conflating releases with vulns.

In no way is this an interns fault. If your entire infrastructure relies on the secure password of ...

checks notes

... a single intern! then you're doing it wrong.

Anyone know if the `smuggler` tool used is available online? Can't find any reference to it in github or elsewhere, and I'm not familiar with it.

Edit: Found it here: https://github.com/gwen001/pentest-tools/blob/master/smuggle...

> Why’d he quit? ... he told me this: at each stage of a company’s growth, they have different needs. Those needs generally require different skills. What he enjoyed, and what he had the skills to do, was to take a tiny company and make it medium sized. Once a company was at that stage of growth, he was less interested and less good at taking them from there.

This is an aspect that gets overlooked in many businesses & careers. I've heard it phrased that companies go through 3 stages: Startup, Scale Up, Optimize. The above quote is a sub-stage of Scale Up. Some people are built for just a single stage and knowing how and where your skillset fits in is crucial to career happiness. As well as knowing when to encourage employees to move on.

Great post and I wish @steveklabnik continued success in his career!

> TVs blaring in waiting rooms when you'd prefer to just sit in silence.

When I can, I turn the TVs off. No one has complained yet.

> Getting motivated to lift 2x a week is another issue...

Was in the same boat until I started doing group classes. Used that to build accountability, motivation, and a "vocabulary" of how the gym works. Now I could spend hours at the gym by myself and love it. Find what works for you, cuz lifting is a blast!

Not training managers on how to manage.

When devs are promoted into management or team lead positions they are not given adequate training on what it means to manage / lead. Thus devs don't learn what good management is, and the stereotype of the bad manager perpetuates.

Password protected zip. And/or wrap in another zip is usually enough to thwart Gmail

As a happy customer of 1Password, it would be great to see you connect with Have I been pwned?[1] for watchtower notifications.

[1] https://haveibeenpwned.com/

corrected - thanks

I'd love to DM you with some questions about Toronto. Can you ping me via my profile info?

> 'progressive' practices such as unlimited vacation

Unlimited vacation is not progressive and it is also unhealthy.

It causes feelings of guilt while on vacation. Often there's an unspoken obligated to check-in (email & chat) when on vacation. And leads to taking fewer vacation days not more. When leaving a company, they have no obligation to pay out accrued vacation days since there is none defined (this may be a Canadian thing). Additionally, it can also come with the unspoken culture of overtime, since it can easily be made up with "more time off".

Having worked with unlimited vacation, if I am ever offered it again, I will decline and negotiate defined vacation into my employment agreement.

Your solution of mapping to a grading system A,B,C,D; or terrible, crap, better, best was mentioned in another thread about this article. It's a common thought, however it's incorrect because you're still leaking substantial information about passwords. By storing entropy of any kind: whole number, graded, > threshold, etc you are weakening your password hash. This is completely unnecessary where better solutions exist: TFA

It's an assumption on my part, and anecdotally a correct one. Having included this entropy example in a number of talks and asking the audience what's wrong, the majority of the technical audience did not know, nor did they have an appropriate guess.

One friend is in a townhouse in North Vancouver. Rented for a while, then bought. Real-estate is stupid silly there. I've also heard talk of people moving to Victoria as an alternative.

I can speak a bit for western canada; Vancouver has seen many of the larger/top companies open offices: Microsoft, Facebook, Amazon, etc. so plenty of jobs to be had there. I live in Calgary and have seen many peers move to Vancouver for better job prospects.

Re: SRED credits - I've been a part of the application process twice. Documentation can be a bit cumbersome, but not much more than 5 minutes summarizing the weeks work in a spreadsheet (for each employee), and tracking their hours spent on related tasks. Add in source control and the numerous artifacts that software devs come up with, means low amount of effort for high payout. And by high payout, I'm talking 1-2 devs salary in a 10 dev shop. We also hired a consulting company that specialized in SRED applications which saved us a ton of overhead. Cost 10-20% of payout, but was worth not having to deal with the application and/or any audits had they occurred.

Question - are you primarily a windows or mac developer? Because the counter part on mac is sublime text and I see a ton of that!

I'd agree 100% on this. As a Canadian, looking at our future career prospects it is in our best interest to learn how to work well as remote employees.

Troy Hunt's original story has more technical details which are worth the read: http://www.troyhunt.com/2016/02/controlling-vehicle-features...

This has actually already been studied/tried in the 70's in Dauphin, Manitoba [1][2]. The experiment saw a decrease in accidents, injuries, and mental health issues.

[1] http://www.cbc.ca/news/canada/manitoba/1970s-manitoba-povert...

[2] http://www.winnipegfreepress.com/local/dauphins-great-experi...

That's not what this means at all. In any given company there are X individuals across Y teams involved in deploying a piece of software (never mind an emergency patch). Stakeholders in this context refers to all those involved to make it happen: devs, QA, PMs, documentation, marketing, etc.

The problem isn't solved as soon as a patch is released. This is serious damage control. Handled poorly it blows up. A lone dev doesn't/shouldn't hold all that responsibility.

Moving the obvious Privacy & Security implications aside, the idea of accessing all of my child's conversations with their doll is disturbing. For parents using this "feature", it normalizes the environment of surveillance which has broad reaching implications for society as a whole: "I listen to my child's conversations therefore the gov't should be able to listen to terrorists".

The research cited re: "role playing helps kids cope with traumatic events is independent of a responding doll/toy", is powerful and parents are best served by creating an environment where a doll/toy is a safe place for confidences vs another vector for helicoptering your children.