ndm - Hackdot

Re:Deprecating password authentication in GitHub API on Tuesday April 14, 2020 @09:18PM (#22873449)

We updated the language, thanks for pointing that out.

Re:CircleCI trusts 8 analytics companies with your source code and API... on Tuesday October 10, 2017 @02:26PM (#15444128)

And this can be ratcheted down further by leveraging something like the measurement protocol. It would eliminate the 3rd party calls/code in the browser while giving GitHub the ability to anonymize the source (e.g. IP address, user agent, etc.). Twitter does this with some of their 3rd party integrations.

Re:Soft U2F: A software-based U2F authenticator for macOS on Monday July 24, 2017 @06:40PM (#14843400)

Are you triggering U2F challenges by visiting sites that support u2f? Opening the app doesn't do anything.

Re:Soft U2F: A software-based U2F authenticator for macOS on Monday July 24, 2017 @06:38PM (#14843388)

TOTP via SMS or apps is required to set up a u2f key on GitHub.

Re:New and improved two-factor lockout recovery process on Tuesday January 31, 2017 @12:41PM (#13533009)

You seem to be failing to acknowledge your privilege to live in the US and earn $8 an hour. There are people who live outside of the US and earn far less. Also, delivering a yubikey might be actually impossible.

> - You set up 2FA with Facebook as well, in which case you're still locked out if you lose the device, or...

Not necessarily. What if one was totp and one was sms? What if you forgot to setup one but not the other? Also, 2FA on Facebook is not required to use this feature. I have been in this situation before.

> - You don't set up 2FA with Facebook, and that allows someone to bypass the 2FA on Google by just guessing your passwords.

This is based on partial information, which I admit has not been well publicized. Facebook implements a time-based lockout after a password is recovered allowing a user to notice activity. It will also issue a "step up challenge" for risky users. Must be known device, known location, etc. or another factor is required to initiate recovery. Those with 2FA will answer a 2FA challenge, those without will fall back to other means or simply not be able to initiate a recovery.

> So this seems to me a very marginal benefit over just skipping 2FA in the first place. If you're not willing or able to deal with real 2FA, then why pretend? Just set up a free password manager and leave it at that.

Password manager adoption amongst the world is still terrible. This is an option that anyone can use without any additional tools or tricks.

Re:New and improved two-factor lockout recovery process on Tuesday January 31, 2017 @01:56AM (#13528392)

Expecting everyone to jump through the hurdles you describe is why we're in this terrible state we are in today. It's just not practical, affordable, or even possible for many.

$38 is a lot of money to a lot of people. Some people just simply don't have a safe storage space either.

Re:New and improved two-factor lockout recovery process on Monday January 30, 2017 @02:32PM (#13524253)

Yep, that's definitely a great solution. Unfortunately, that is not practical for the vast majority of people.

Re:GitHub Enterprise SQL Injection on Sunday January 08, 2017 @12:49PM (#13350915)

While there are many ways to catch this sort of thing (code review, static analysis, education) I have to place the "blame" here on ActiveRecord. The 'order' API takes an arbitrary string by default. 99.999% of the time, this value can be restricted to a column name or can safely be escaped. For the 0.0001% of the time that something more complex (e.g. Sorting by a calculation like sum(column)) should require a separate, more cautious or complex API call. The common assumption is that all ActiveRecord APIs are "safe" and that simply isn't the case. Brakeman couldn't catch this since it's in Sinatra code and not rails code. Code review didn't catch this because the API was assumed safe by reviewers. Education didn't catch this because not everyone has seen rails-sqli.org. Mind boggling, but still very possible.

Re:The future of SaaS hosted Git repository pricing on Thursday May 12, 2016 @09:52PM (#11688120)

https://blog.twitter.com/2016/the-release-of-pants-10

> Today, Twitter is excited to announce participation in the first major release of the Pants open source project: 1.0.0, an open source build tool for monorepo-style source repositories.

They (for the most part) had two repos as of 11/2014. They certainly were moving towards one. Here's a public thread mentioning the two repos: science (mostly jobs, shared code) and birdcage (mostly services). https://groups.google.com/forum/#!topic/pants-devel/60Vzkole...

Re:Code Climate launches Security Monitor on Wednesday March 20, 2013 @12:12AM (#5405597)

"Automate that and spend the rest of your time reviewing for things that can't be trivially automated" - pretty much the mantra behind any successful security program. A false-positive/negative is usually fixed faster than any feature. <3

Re:Code Climate launches Security Monitor on Wednesday March 20, 2013 @12:10AM (#5405589)

Having used static analysis security tools for other languages, no. Ignoring the fact that it is open source, it blows away every single other tool I have used in terms of speed, accuracy, and actionability.

I would _LOVE_ to be proven wrong on this one.