Josh Gibbs

[Josh Gibbs @appsecjosh]

@janetgregoryca I hope you have a speedy recovery!

[Josh Gibbs @appsecjosh]

@jaysonstreet @Delta 3 hours by FAA: https://t.co/UC0V7QeYxw

[Josh Gibbs @appsecjosh]

@_lennart I’m amused by the Delta livery. I had to double check whether they ever operated a 340.

[Josh Gibbs @appsecjosh]

@maaretp I agree. It really depends on tools in use when it comes to analysis time. Some are 90%+ accurate, so analysis is a waste of time. Some are ~20%, so jumping to fixing might be a waste.

[Josh Gibbs @appsecjosh]

@maaretp The tricky thing with fixing is that it can be “whack a mole.” If you have 100,000 or more, which 500 do you start with? The ones actually surfaced have greatest benefit. The “low hanging fruit” where you’re just bumping a dependency version are another great start.

[Josh Gibbs @appsecjosh]

@maaretp Some tools do indicate it, but you also search the various databases such as https://t.co/OqWhjjUOSQ

[Josh Gibbs @appsecjosh]

@maaretp If there are known exploits in use, definitely.

[Jake Williams @MalwareJake]

TFW the incident response team needs an incident response team...

[Josh Gibbs @appsecjosh]

@EirikMarquez Awesome! I’ll DM you with some ideas of a few local places.

[Josh Gibbs @appsecjosh]

@EirikMarquez What type of work (development, security, something else?) are you interested in for your internship?

[Josh Gibbs @appsecjosh]

@johncutlefish Maybe another category: Power / Status. Ex:
- Passive aggressive (feigned support)
- Rewarded sabotage
- Fools errand projects forced by leaders to undermine teams for political gain
- Self before business

[Josh Gibbs @appsecjosh]

@TheTestingMuse @AjParadith @DanAshby04 @RobMeaney @ministryoftest @maaretp Like https://t.co/EYO96vxTI0 ?

[Josh Gibbs @appsecjosh]

@DanAshby04 @RobMeaney Sounds like Security BSides. https://t.co/SJkeCYsePU

[Josh Gibbs @appsecjosh]

@DiscernedEd @abostickcpa @BFryback Yup, a little bit south of there!

[Josh Gibbs @appsecjosh]

@abostickcpa @BFryback All-benny

[Josh Gibbs @appsecjosh]

@_dominicp

[Josh Gibbs @appsecjosh]

@ndm What’s your favorite spicy food?

[Josh Gibbs @appsecjosh]

@manicode Maybe pre-commit is fine for some stuff and pre-push is right for other stuff while other things are CI only. It’s a tradeoff between how big the workflow interruption is and the speed of feedback. The cumulative interruption may be worse than delayed feedback.

[Josh Gibbs @appsecjosh]

@noahsussman If mimicking people, the estimates should begin to drift toward the average of the session after being called for more than a few times in 15 minutes.

[Josh Gibbs @appsecjosh]

@elmoray They’re building a solid crew of folks! Say hi to Rick and Gigi. 😃