kowsik

'Reflections on Trusting Trust' https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

Ultimately, the web is an attack vector that no one is immune to. Did you read the Syria hack recently? Just a skype chat with an attractive opposite-gender is enough to download a piece of malware masquerading as a picture you really want to see. While the human aspect has always been a key element of getting hacked, products that claim to distinguish the good vs. bad are failing big time. And this has been the pillar of enterprise security (classifying good against bad) for the last 20 years and is starting to show its age.

True that about the security engineers, but they are at the mercy of products that claim to distinguish good from bad and this has never worked, IMHO. How the hell can you write signatures against malware/documents/web-sites/files/attacks/blah when there's so much diversity and quantity of stuff to keep up with?

Disclaimer: I built the first IPS to be commercialized and yes we used signatures amongst other things.

+1 on the "sophisticated" == 'SQL injection', though it's all speculation at this point.

The security industry/products seriously need a make over. So much money spent and yet, hacks just keep getting bigger and worse.

[edit]: Disclaimer - I'm CTO at @menlosecurity.

See Ben Kepes' review here: http://wp.me/p8KWj-3Uj

Depends on what your expectations are. I built https://www.delayed-tweets.com for myself and I'm a heavy user of it and I tinker with it when I have time (Heroku + Stripe, if you want to know). If it also becomes a source of income, so be it. Otherwise, it costs me just a little more than using an alternate service to do the same thing (like HootSuite, Buffer, etc). But, I get to tinker with it on the side, learning new things and making little improvements as I have time. So 6 months from now, I don't have to be disappointed that it didn't go anywhere. A side project is exactly that, something that you tinker with while you still have a day job.