rsobers
Root Privilege Escalation on Azure AI and HPC Workloads Using Aznfs-Mount
CrossTalk and Secret Agent: Two Attack Vectors on Okta's Identity Suite
URL Spoofing in Box, Google, and Zoom
Bypassing Box's SMS-Based MFA
Bypassing Box's one-time password MFA
Salesforce bug exposes Outlook/Gmail calendars
BlackMatter Ransomware
New strain of Qbot banking malware actively compromised thousands of victims
The World in Data Breaches
Adventures in Malware-Free Hacking
Troy Hunt's Web Security Fundamentals Course
Guide to the GDPR Breach Notification Rule
The Right to Be Forgotten and AI
Practical Powershell for IT Security: File Access Analytics
Curated list of threat intelligence resources
Ways for a conference to upset their speakers
Internet Security Basics by Troy Hunt
Cylance Discloses Voting Machine Vulnerability
The Definitive Guide to DNS TTL Settings
1. A rich and powerful person parroting Trump's evil statements --> ban from YC.
2. A rich and powerful person helping put Trump in a position to turn his evil statements into reality for an entire country --> No ban from YC.
Advice for Young Makers
The Enemy Within: A Free Course on Insider Threats by Troy Hunt
HaveIBeenPwned.com Creator's Course on Ransomware
Football player hacked live during draft, agent blames Silicon Valley
Doing this right now manually piping data into PostgreSQL via Heroku and using Chartio to visualize and query.
I'd just want more proof than "Bob says he does a bang-up job" -- there's so much incest in enterprise, recommendations and upvotes mean nothing.
But why must demonstration of skill be limited to elite red-team style pentesting? You could devise challenges geared at demonstrating all sorts of knowledge (HIPAA, PCI, websec) basic or advanced.
If you've seen the sad state of PCI audits in particular these days, you'll get my drift. I think there's a huge opportunity here to raise the quality bar with your marketplace.
I think what patio11 is doing with Starfighters.io is orders of magnitude better. Run developers through a gambit of supremely difficult tests via a fun CTF-type game and pair the best hackers with the highest enterprise bidder. Works not just for pentesters, but all devs really.
Also, I know where to get the best pentesters because they're listed on all the top companies' bug bounty pages. It's proof of skill I'm after, not some Gartner-esque gatekeeper telling me who's best because they've "background checked" them.
Give me a system more like StackOverflow or Starfighters where I can see the work. Not something subjective like eBay or Yelp, which can be easily gamed.