David G

Web application & cloud security

[David G @Primed_Mover]

Sadly not making it to fwd:cloudsec this year, but I have several tickets I'm selling for face value if you're interested.

[SecuriTEA & Crumpets @SecuriTnC]

The next SecuriTEA & Crumpets is out! Check out my chat with @Primed_Mover where we talk about Egress Filtering in AWS, his academic work, and #supplychain security #infosec #appsec https://t.co/uViIHMrPOj

[CactusCon @CactusCon]

Join us online or in person on January 27th with @Primed_Mover presenting:

"Egress Filtering in AWS; And other Sisyphean tasks"

Register now or check out our amazing schedule @ https://t.co/pvnwLQb1P7!

#cybersecurityconference #infosec #cc11

[David G @Primed_Mover]

@leifdreizler 2 mentions in one tl:dr sec, is that a record?

[Mosquito Capital @MosquitoCapital]

I've seen a lot of people asking "why does everyone think Twitter is doomed?"

As an SRE and sysadmin with 10+ years of industry experience, I wanted to write up a few scenarios that are real threats to the integrity of the bird site over the coming weeks.

[kadhim (＾ｰ^)ノ @kadhim]

THE FTX FIRST DAY DECLARATION

New CEO John Ray is scathing about Sam Bankman-Fried's management.

"Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information."

https://t.co/iTGlCA9olr

[David G @Primed_Mover]

Best explanation of Oauth2.0 from @antonal80

[Jason Geffner @JasonGeffner]

My organization is hiring interns! See https://t.co/o54ge4ubxY to apply!

[Lyft Engineering @lyfteng]

New Blog Post! Software Engineer Dean Liu takes us through how the Security team achieved egress network traffic filtering for all services at Lyft:

https://t.co/wuDPwJo8m7

[60 Minutes @60Minutes]

“It’s almost like [Chinese company Bytedance] recognize[s] that technology’s influencing kids’ development, and they make their domestic version a spinach TikTok, while they ship the opium version to the rest of the world,” says Tristan Harris. https://t.co/Jro1FTGjKB

[David G @Primed_Mover]

Happy to say that my talk, "Egress Filtering in AWS; And other Sisyphean tasks" has been accepted!

[CactusCon @CactusCon]

Dang y'all, we had so many incredible -- and some *spicy* -- submissions this year it has been so tough to narrow it down.

We should have confirmations sent to speakers by some time this weekend. Thanks to ALL OF YOU who submitted, it was tough competition this year!

#cc11

[Eric Mill @konklone]

Oh, now this is a great step forward - the @FTC just released an order imposing security requirements on Drizly that not only require MFA be used internally, but that the MFA be phishing resistant:

https://t.co/6mrXvk3kXo

[David G @Primed_Mover]

Back to on-prem/ colo is becoming a very fashionable idea! I think the biggest impediment might be staffing.

[DHH @dhh]

"Of course it's expensive to rent your computers from someone else. But it's never presented in those terms. The cloud is sold as computing on demand, which sounds futuristic and cool, and very much not like something as mundane as 'renting computers'." https://t.co/I7xDQEjPBa

[Patrick Coffee @PatrickCoffee]

Advertisers have been tracking how you browse, watch and shop online and IRL for years.

Now Uber will let brands target you based on where, exactly, you’re going at the moment — and where you’ve been.
https://t.co/UwQYT9EkJt

[Infosecurity Magazine @InfosecurityMag]

🛑 [NEWS] US video game publisher 2K has warned players of its titles not to click on links sent out by its help desk recently, as they are likely to be malicious > @philmuncaster reports https://t.co/xV8FWJ3LrQ #malware #passwordsecurity

[Scott Piper @0xdabbad00]

It's great to see a company talk about the migration and some of the gotchas of migrating to FIDO2 enforcement. "Buy yubikeys" is NOT the work involved in these efforts. I'm baffled that neither Yubico nor Okta offer meaningful assistance in these migrations.

[The Register @TheRegister]

Store credit card numbers in a debug log, lose millions of accounts. Cost? $1.9m https://t.co/E5nJijpGrv

[switched @switch_d]

FCC to ban all new Huawei and ZTE equipment on national security grounds | Ars Technica https://t.co/lYu56MpEtg

[David G @Primed_Mover]

@1njection @MikeGizara4624 I uhhhh don't know what to tell you if you've never been to a conference with any payment for speakers, even if it's just a badge, dinner, and a gift card.

[David G @Primed_Mover]

There are exceptions, like when encryption provides an additional layer of defense in case a resource is inadvertently made public.

[David G @Primed_Mover]

I'd take this a step further and argue TLS and encryption at rest in the cloud are also pretty tinfoil hat.

[Clint Gibler @clintgibler]

🎩 Confidential Computing Is for the Tinfoil Hat Brigade

@QuinnyPig's 🌶️ take: the threat model for confidential computing doesn't make sense

e.g. Preventing data access from cloud operators, malicious admins, privileged software like hypervisors

https://t.co/8nzzJbcrbf