| Blog post: Ryan Huber - Distributed Security Alerting | |
| https://medium.com/several-people-are-coding | |
| Video: Zane Lackey - Building a Modern Security Organization | |
| https://duo.com/blog/duo-tech-talk-building-a-modern-security-engineering-organization | |
| Krebs on Security Blog | |
| https://www.krebsonsecurity.com | |
| Sony Breach |
On Twitter the other day, I was lamenting the state of OCSP stapling support on Linux servers, and got asked by several people to write-up what I think the requirements are for OCSP stapling support.
Support for keeping a long-lived (disk) cache of OCSP responses.
This should be fairly simple. Any restarting of the service shouldn't blow away previous responses that were obtained. This doesn't need to be disk, just stable - and disk is an easy stable storage for most server
| #!/usr/bin/env python | |
| import imaplib | |
| import os | |
| import logging | |
| import optparse | |
| # LABEL = 'support' | |
| # QUERY = 'before:2015-06-01 -label:to-delete' | |
| # DEST = 'to-delete' | |
| LABEL = 'to-delete' |
Ideas are cheap. Make a prototype, sketch a CLI session, draw a wireframe. Discuss around concrete examples, not hand-waving abstractions. Don't say you did something, provide a URL that proves it.
Nothing is real until it's being used by a real user. This doesn't mean you make a prototype in the morning and blog about it in the evening. It means you find one person you believe your product will help and try to get them to use it.
I was at Amazon for about six and a half years, and now I've been at Google for that long. One thing that struck me immediately about the two companies -- an impression that has been reinforced almost daily -- is that Amazon does everything wrong, and Google does everything right. Sure, it's a sweeping generalization, but a surprisingly accurate one. It's pretty crazy. There are probably a hundred or even two hundred different ways you can compare the two companies, and Google is superior in all but three of them, if I recall correctly. I actually did a spreadsheet at one point but Legal wouldn't let me show it to anyone, even though recruiting loved it.
I mean, just to give you a very brief taste: Amazon's recruiting process is fundamentally flawed by having teams hire for themselves, so their hiring bar is incredibly inconsistent across teams, despite various efforts they've made to level it out. And their operations are a mess; they don't real
