jbaviat

I _do_ believe the author implied universality on purpose.

That’s also close to the YC motto: “make something people want”.

Or as Paul Graham puts it: be good. https://paulgraham.com/good.html

How about using tor to help with DNS redundancy? https://en.wikipedia.org/wiki/Tor_(network)

Quoting Bose:

| Bose SoundTouch systems were introduced into the market in 2013. Technology has evolved since then and we’re no longer able to sustain the development and support of the cloud infrastructure that powers this older generation of products. We remain committed to creating new listening experiences for our customers built on modern technologies.

I used to live in France. We had no A/C, enough climate consciousness not install it, though our east-facing windows were bringing important heat at sunrise. We had awnings installed, with an HomeKit connection, so we could automatically have them closed before sunrise, and opened once the sun would leave this face of the building. We saved a few degrees in this way.

> There’s a plethora of other problems that make flying cumbersome

How about CO2 emissions?

PyMiniRacer (original) author here. PyMiniRacer is definitely a way to run insecure code, but as pointed, the several CVEs in V8 require measures beyond "just" relying on PyMiniRacer to make it safe.

For the record PyMiniRacer was victim of a CVE itself https://nvd.nist.gov/vuln/detail/CVE-2020-25489 - a heap overflow, my mistake.

1. Total control over what APIs the user's code can call: you kinda got it... users can just do plain JS 2. Memory limits: you got it 3. Time limits: you got it, but the current model is unreliable when used at high levels of CPU and a high number of threads.

And thank you so much bpcreech for taking back the ownership of PyMiniRacer!

I built a tool to extract ROP gadgets from binaries [0], which got noticed by a guy at Apple, and I ended up spending 4 years there. And this guy became Sqreen CEO and my (incredibly awesome) cofounder.

[0] https://github.com/aviat/skyrack

[Disclaimer: I worked in Apple Red Team]

What if this isn’t a good news for 99% of Apple users?

That’s obviously an amazing measure for the 1% high targets out there.

But what about the other 99%? Does that create an incentive for Apple to strengthen Lockdown Mode security to the detriment of the regular mode (should we call it Unsafe Mode)?

I’m afraid that this architecture will make it harder to prioritize security features or fixes for the 99% users. Developers bandwidth is limited, they can’t fix all bugs. Hence if you have to choose between one bug impacting the 1% most important users (from a security standpoint) versus one bug impacting the 99% others, which would you choose?

Would such an architecture have led to the emergence of Blastdoor[1] - which attempts at mitigating iMessage attachement exploits, but is now useless in Lockdown mode?

My hope here is that by reducing attack surface, Lockdown mode will make exploits much easier to fix (as they’ll target a limited area), allowing to strengthen the system core while freeing bandwidth to implement longer term, Blastdoor like mitigations.

[1] https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

Slides from the Center for Humane Technology, who authored the social Dilemma [0].

[0] https://www.humanetech.com/the-social-dilemma

Je suis en train de me faire un devis pour

This reminds me a lot about the goals behind the center for humane technology, and their amazing podcast https://www.humanetech.com/.

They also are the ones behind the Netflix documentary « the social dilemma ».

I’m Sqreen CTO and co-founder, now working on building AppSec at Datadog. You can keep using Sqreen as we’re maintaining the service for at least a year. Right now we are focused on integrating Sqreen capabilities to Datadog, so you will be able to migrate at some point! Stay tuned for that, and please get in touch (https://twitter.com/jbaviat ) if you’d like to be a design partner.

Sqreen | YC W18 | Product Security Engineer | Paris | Full-Time | Remote |

Sqreen | YC W18 | Data Engineer | Paris | Full-Time | Remote |

Sqreen | YC W18 | Agent Principal Engineer | Paris | Full-Time | Remote |

Sqreen | YC W18 | Principal Engineer, Platform Squad | Paris | Full-Time | Remote|

Sqreen (YC W18) is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. What Application Performance Management tools (like New Relic) do, but for security.

We are currently looking to fill a few critical roles in a European friendly timezone (+/- 2 hours) for our Product & Engineering team:

Product Security Engineer - a software engineer with a security focus who will help to secure our products for our customers.

Data Engineer - a backend engineer who is passionate about all things data processing, platform availability & performance and scalability.

Agent Principal Engineer - a technical lead who will be responsible for driving the overall technical vision across our entire agent library (7 languages and counting!).

Principal Engineer, Platform Squad - a technical lead who loves technical strategy, mentoring and anything architecture related.

All of these roles are open to full remote with a European compatible time zone.

You can find more details on our careers site:

https://www.sqreen.com/company#jobs

One interesting thing is that it announces that ssh-rsa will be disabled due to price drop of SHA-1 collision attacks (~50k$).

Sqreen | Java agent software engineer | Paris | Full-Time | Remote (Paris timezone) |

Sqreen | Backend engineer | Paris | Full-Time | Onsite |

Sqreen | Cross agent engineer | Paris | Full-Time | Onsite |

Sqreen (YC W18) is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. Pretty much what an Application Performance Management tool (like New Relic) is doing, but for security.

We are currently looking for Java agent engineers (e.g. you need to love byte code instrumentation [1]) and C/C++ [3] [4] [5] (remote anywhere in European timezone) to help us expand the capability of our agents, as well as a senior level Backend developer (knowledgeable or willing to learn Python) to build new functionality on our backend (based in our Paris HQ).

Also, we're looking to hire a Cross Agent Engineer in Paris too!

You can find more details on our careers site [5]

[1] [https://blog.sqreen.com/building-a-dynamic-instrumentation-a...

[2] [https://blog.sqreen.com/how-to-build-a-waf-at-the-applicatio...

[3] [https://blog.sqreen.com/how-we-built-v8-natively-on-arm/](ht...

[4] [https://blog.sqreen.com/building-a-native-add-on-for-node-js...

[5] [https://www.sqreen.com/company#jobs](https://www.sqreen.com/...

Sqreen | C software engineer | Paris | Full-Time | Remote |

Sqreen | Low level Java software engineer | Paris | Full-Time | Remote |

Sqreen | Backend engineer | Paris | Full-Time | Onsite |

Sqreen | Product Manager | Paris | Full-Time | Onsite |

Sqreen (YC W18) is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. Pretty much what an Application Performance Management tool (like New Relic) is doing, but for security.

We are currently looking for low-level Java (e.g. byte code instrumentation) and C/C++ developers to help us expand the capability of our agents, as well as backend developers (knowledgeable or willing to learn Python) to build new functionality on our backend.

Also, we're looking to hire our first Product Manager to define & work with the squads to keep delivering more value to our users.

You can find more details on our careers site:

https://www.sqreen.com/company#jobs

You are correct, our content security policy is not perfect, and we are gradually improving it. Security is a journey and there is no such thing as perfect security. We are striving to incrementally improve everything we are doing as our team is scaling.