somethingnew

Discord | Senior Software Engineer, Application Security | REMOTE (US West Coast) or San Francisco, CA | $196K-$245K base + equity

Discord is where communities and friend groups spend time together, on desktop, mobile, and now more and more inside games and third-party apps built on our platform. That surface area, plus a huge, engaged, occasionally adversarial user base, makes application security a genuinely hard and interesting problem here.

We are hiring a Senior Software Engineer to join the Application Security team. This is hands-on product engineering: building security features that protect user accounts, strengthening authentication and session security, and improving security-critical services. You will work directly with product teams to ship user-facing account security tools and address emerging threats.

Stack: Python primarily, some TypeScript/React, some Rust, occasional JavaScript. Runs on GCP.

Looking for: hands-on AppSec experience (not just compliance-flavored security), comfort reading and writing code across languages, experience shipping production software, and sound judgment on prioritizing real risk over checklist security. Experience with authentication, passkeys, MFA, or session management is especially relevant.

Location: Remote from the US West Coast. If you are in the Bay Area, our SF office is an option. Relocation to the Bay Area is not required.

Interview process: recruiter call, coding round, HM interview, virtual onsite, decision.

Apply: https://discord.com/jobs/8656854002

Discord | Senior Software Engineer, Application Security | San Francisco, CA | ONSITE | $280K–$330K TC

Discord is where communities and friend groups spend time together, on desktop, mobile, and now more and more inside games and third-party apps built on our platform. That surface area, plus a huge, engaged, occasionally adversarial user base, makes application security a genuinely hard and interesting problem here.

We're hiring a Senior Application Security Engineer to join the Product Security team. Responsibilities include threat modeling and secure design review with product and platform teams, building and improving AppSec tooling (SAST/DAST/dependency scanning), and working directly with engineering teams to remediate findings.

Stack: Python primarily, some TypeScript/React, some Rust, occasional JavaScript. Runs on GCP.

Looking for: hands-on AppSec experience (not just compliance-flavored security), comfort reading and reviewing code across languages, and sound judgment on prioritizing real risk over checklist security.

Interview process: recruiter call, coding round, HM interview, virtual onsite, decision.

Apply: https://job-boards.greenhouse.io/discord/jobs/8656854002

Here's a summary from the Docker perspective https://blog.docker.com/2016/04/docker-security/

Source: https://github.com/somethingnew2-0/hacker-news-tab

Besides Session IDs and Session Tickets[1] which already exist in the TLS protocol. He could be referring to the Token Binding Protocol Draft[2] which, quoting from it's summary, "allows client/server applications to create long-lived, uniquely identifiable TLS bindings spanning multiple TLS sessions and connections".

[1] https://en.wikipedia.org/wiki/Transport_Layer_Security#Resum...

[2] https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01

Not having to worry about calculating the length of the message before transferring it?

How does it work? Brute force? Rainbow tables?

My university uses them for file storage and sharing, so I imagine they have many large enterprise clients.

Has this never been posted before?

Running Google Hangouts through Tor would work well as it uses https by default. As long as he's using a throwaway Google account, it seems good to me.