Catherine Kim

Technical Customer Success Manager @GripSecurity

[Catherine Kim @catherinesjkim]

DC Plane Crash - What REALLY Happened? https://t.co/ikTN3lXVPT via @YouTube

[Katia Ameri @KatiaAmeri]

✨🌴 I’m beyond excited that today kicks off our BIGGEST #LATechWeek yet! With over 600 events across AI, fundraising, SaaS, media & entertainment, and more, it’s incredible to see the momentum building. The best part? Cross-pollination between local talent and those flying in from everywhere. Today alone, we’ve got 80+ events, including a16z’s Official Kickoff at 6PM. 🚀

📆 Here’s what’s happening on Day 1:

AI
• 9:00 AM: Google AI Salon: The Future of Entertainment & Creativity
• 10:30 AM: AI Communities - The Future of Insights, SocialTrait Inc
• 3:00 PM: AI Titans Panel, USC Information Sciences Institute
• 4:00 PM: LA AI Builders Demos & Happy Hour, Artium AI, Freeplay, Silicon Valley Bank
• 5:30 PM: AI and DeepTech Mixer, Lux Capital, Morgan Stanley, Fenwick, Orrick
• 6:00 PM: Healthcare AI Founder Dinner (Invite Only), A16Z

Health & Wellness
• 7:00 AM: Pitch and Run, PitchandRunLA
• 7:00 AM: AM Run & Workout, Bankless Ventures
• 7:00 AM: Best Morning Ever, Powerful Stuff, Drybaby
• 11:00 AM: Tech Week Recharge at Hub 101, Steven Dorfman Center for Innovation & Entrepreneurship

Fintech
• 8:00 AM: Startup Banking Breakfast, J.P. Morgan Startup Banking Team - LA
• 12:00 PM: High Growth Consumer Brands Fireside Chat, J.P. Morgan Innovation Economy Team

Web3
• 2:30 PM: The Culver Cup: GenAI Film Competition, AWS
• 5:00 PM: The Future of Tech: Web3 x AI, Orbis86
• 6:00 PM: Real Estate Investments & Technology, LightDAO, Mission Matters

AgTech
• 2:00 PM: Future of Farming: AI and Indigenous Collaboration for a Sustainable Food System, Celebration Nation Inc

And More!
• 7:00 AM: Lumos House in LA, Andrew Yeung, Blindspot
• 9:00 AM: LIVE a16z Podcast Recording
• 9:00 AM: LA Tech Breakfast Club
• 6:00 PM: VCFamilia Annual Awards Reception

Full schedule at https://t.co/Ow2I62jXkH
Follow @techweek_ for live updates!

[Inferam @InferamAI]

Where has this been all my life?

[Lex Fridman @lexfridman]

I visited xAI and Tesla supercomputer clusters in Memphis & Texas, and was blown away by the rapid rate of progress. It was fascinating to watch Elon & team constantly improve every aspect of the process.

Also, as a human, it was a bit surreal (and humbling) to walk around inside the "brain" of a giant superintelligent computer that is quickly becoming more powerful.

The future is going to be wild! 🤯

[Elon Musk @elonmusk]

Wow, America really is the land of opportunity!

[Aakash Gupta @aakashgupta]

Copy-paste Amazon's meeting agenda. It works:

[TCM Security @TCMSecurity]

LIVE Hacking | New Course | AppSec | Cybersecurity | Pentesting https://t.co/DHiqURf8UM

[Sahn Lam @sahnlam]

Securing REST APIs

It is important to make sure that only approved users and applications can access or make changes to resources in our API.

Here are some common was to secure REST APIs:

1. 𝗕𝗮𝘀𝗶𝗰 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻

This sends a username and password with each request to the API. It’s straightforward, but not very secure unless used witn encryption like HTTPS.

Good for simpler apps where advanced security is not critical. Should be combined with encrypted connections.

2. 𝗧𝗼𝗸𝗲𝗻 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻

This uses tokens, like JSON Web Tokens (JWT), that are exchanged between the client app and server. Login information is not sent with each request.

Better for more secure and scalable apps where not sending credentials each time is essential.

3. 𝗢𝗽𝗲𝗻𝗜𝗗 𝗖𝗼𝗻𝗻𝗲𝗰𝘁 𝗮𝗻𝗱 𝗢𝗔𝘂𝘁𝗵

These allow limited third-party access to user data without exposing passwords. OpenID Connect handles user authentication and OAuth handles authorization.

Perfect when third-party services need controlled access to user data, like when integrating with Google, Facebook, or Twitter.

4. 𝗔𝗣𝗜 𝗞𝗲𝘆 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻

This gives unique keys to users or apps which are sent in request headers or query parameters. Simple to implement but may not be as robust as token or OAuth methods.

Good for basic access control when security needs are moderate. Allows access to specific API functionalities without complex user permissions.

Securing our API should be a top concern. The method chosen should match the sensitivity of the data and required protection level.

–
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/kNfv0DVDdf

[Sahn Lam @sahnlam]

Session, cookie, JWT, token, SSO, and OAuth 2.0 - what are they?

These terms relate to managing user identity when logging into websites. You declare who you are (identification), your identity is verified (authentication), and you're granted appropriate permissions (authorization). Many solutions exist and continue to emerge.

From simple to more complex:

🔹WWW-Authenticate is very basic. The browser prompts for username and password. It lacks control over the login lifecycle, so is rarely used today.

🔹Session-cookie is prevalent in browsers. Servers maintain session storage, and browsers store session IDs in cookies. Mobile apps can use cookies in web views but often prefer tokens for native functions.

🔹Tokens are encoded data used for validation, allowing clients to avoid sending credentials repeatedly. They ensure data integrity but aren't always encrypted.

🔹JWT provides a standardized format for tokens. They are digitally signed to ensure their authenticity. Because JWTs can hold session or user data in their claims, servers don't need to store this information separately for verification.

🔹SSO (single sign-on) lets you log in once then access multiple sites. Uses central authentication service (CAS) to maintain cross-site info.

🔹OAuth 2.0 authorizes one site to access your info on another site.

–
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/kNfv0DVDdf

[Black Hills Information Security @BHinfoSecurity]

John Strand has some wise words for us today: https://t.co/HafPRS7Cku

If you'd like more helpful educational content, check out the Infosec Survival Guide: Second Volume -- https://t.co/eK8zlhe0ch

[Greg Brockman @gdb]

once you deeply understand the why, you can fix it

[Elon Musk @elonmusk]

Libertad!

[UHN Plus @UHN_Plus]

🇺🇸 | Javier Milei: "¡Viva la libertad carajo!"

[Greg Brockman @gdb]

best way to get hard things to work is to first focus on getting all the easy things to work perfectly

[Sahn Lam @sahnlam]

Choosing the Right Database

When deciding which type of database to use, it can be overwhelming to choose from the many available options. Here's a brief summary of some common database architectures and their use cases:

- Relational databases: These are versatile and can solve almost any problem. They are suitable for structured data with well-defined relationships between entities.

- In-memory stores: With their high speed and limited data size, in-memory databases are perfect for applications that require fast operations, such as caching or real-time analytics.

- Time-series databases: Designed to store and manage time-stamped data, these databases are ideal for monitoring systems, IoT applications, and financial trading platforms.

- Graph databases: If the data involves complex relationships between unstructured objects, graph databases could be a good option. They handle highly connected data, such as social networks or recommendation engines.

- Document stores: These data stores are suitable for storing large, immutable data, such as user profiles, product catalogs, or content management systems with large amounts of audio and video content.

- Wide column stores: Typically used for big data and analytics, wide column stores are great for semi-structured data. They are designed for high scalability and performance.

–
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/6j06DUIbVn

[Bytebytego @bytebytego]

Top 12 Tips for API Security

- Use HTTPS
- Use OAuth2
- Use WebAuthn
- Use Leveled API Keys
- Authorization
- Rate Limiting
- API Versioning
- Whitelisting
- Check OWASP API Security Risks
- Use API Gateway
- Error Handling
- Input Validation

--
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/FIzCeaWsZV

[Andrej Karpathy @karpathy]

Returning from an experimental ~2 week detox from the internet. Main takeaway is that I didn't realize how unsettled the mind can get when over-stimulating on problems/information (like a stirred liquid), and ~2 weeks is enough to settle into a lot more zen state.

I'm struck by how an over-stimulated brain automatically keeps bubbling up problems into consciousness, creating a state of persistent anxiety and nervousness. After some time, in the settled state, this activity just... stops. You can sit down and your brain doesn't immediately go into some kind of problem solving overdrive, it just stays silent. Nothing happens.

I'm sure this could read a bit duh to many, but I haven't been to this subset of "brain dynamics" state space in I think a very long time and it is comforting to know that 1) it exists, and 2) you can visit, if you like, but the journey there takes a few weeks.

Anyway, where were we :D

[Thomas Roccia 🤘 @fr0gger_]

🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)!

I hope it helps to make sense of the information out there. Please treat the information "as is" while the analysis progresses! 🧐 #infosec #xz

[Alex Xu @alexxubyte]

Roadmap for Learning Cyber Security

By Henry Jiang. Redrawn by ByteByteGo.

Cybersecurity is crucial for protecting information and systems from theft, damage, and unauthorized access. Whether you're a beginner or looking to advance your technical skills, there are numerous resources and paths you can take to learn more about cybersecurity. Here are some structured suggestions to help you get started or deepen your knowledge:

🔹 Security Architecture
🔹 Frameworks & Standards
🔹 Application Security
🔹 Risk Assessment
🔹 Enterprise Risk Management
🔹 Threat Intelligence
🔹 Security Operation

–
Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): https://t.co/uc5M7CdXXC