News for hackers. Stuff that matters.

rsobers

Re:Cylance Discloses Voting Machine Vulnerability on Sunday November 06, 2016 @01:19AM (#12883663)
Ugh.
Re:The 2016 Election on Monday October 17, 2016 @03:25PM (#12728492)
Agreed. This is crazy:

1. A rich and powerful person parroting Trump's evil statements --> ban from YC.

2. A rich and powerful person helping put Trump in a position to turn his evil statements into reality for an entire country --> No ban from YC.

Eh, you'd be surprised how much value a company can get just by marrying a few data sources (e.g., marketing automation + google analytics + CRM).

Doing this right now manually piping data into PostgreSQL via Heroku and using Chartio to visualize and query.

Re:Show HN: Building a Market for Penetration Testing on Friday January 29, 2016 @08:18AM (#10994999)
In my experience, skilled people have no qualms about showing their work. I don't care if it's through a game, research, conference talks, whatever.

I'd just want more proof than "Bob says he does a bang-up job" -- there's so much incest in enterprise, recommendations and upvotes mean nothing.

Re:Show HN: Building a Market for Penetration Testing on Thursday January 28, 2016 @11:23PM (#10993477)
I'll be interested to see what you come up with!

But why must demonstration of skill be limited to elite red-team style pentesting? You could devise challenges geared at demonstrating all sorts of knowledge (HIPAA, PCI, websec) basic or advanced.

If you've seen the sad state of PCI audits in particular these days, you'll get my drift. I think there's a huge opportunity here to raise the quality bar with your marketplace.

Re:Show HN: Building a Market for Penetration Testing on Thursday January 28, 2016 @08:38PM (#10992909)
I like the idea of a marketplace, but I don't think background checks and references are the way to build a credible list of the world's best pentesters.

I think what patio11 is doing with Starfighters.io is orders of magnitude better. Run developers through a gambit of supremely difficult tests via a fun CTF-type game and pair the best hackers with the highest enterprise bidder. Works not just for pentesters, but all devs really.

Also, I know where to get the best pentesters because they're listed on all the top companies' bug bounty pages. It's proof of skill I'm after, not some Gartner-esque gatekeeper telling me who's best because they've "background checked" them.

Give me a system more like StackOverflow or Starfighters where I can see the work. Not something subjective like eBay or Yelp, which can be easily gamed.

Older »