Comments URL: https://news.ycombinator.com/item?id=12014011

Points: 3

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=11946083

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=11898411

Points: 4

# Comments: 0

Do you have in-house security controls? Third-party penetration tests? Independent code audits? Bug bounty programs?

Do you forsake security entirely in favor of getting it shipped?

Comments URL: https://news.ycombinator.com/item?id=11754147

Points: 2

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=11683175

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=11660015

Points: 3

# Comments: 0

I wouldn't ever use something like FizzBuzz to assess a candidate. It would be more of "here's a mostly finished sample application with a corresponding SQL file, add this feature (e.g. a search bar for a blog) and fix any (intentionally introduced) security bugs you find".

They would be evaluated based on how successfully they complete the main task, and if they have an eye for finding/patching vulnerabilities, that's a bonus that can be used as a secondary selector if a lot of candidates pass. If no one does, it won't be used against them.

That's how I'd approach it, personally. Something specific to the kind of work we're doing, but abstract enough to be approachable without a lot of insider knowledge.

All companies can afford to waste less money than they need too.

Comments URL: https://news.ycombinator.com/item?id=11235744

Points: 2

# Comments: 0

No. RSA security depends on getting your parameters right and padding.

http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-...

http://framework.zend.com/security/advisory/ZF2015-10

> Russians cryptoexperts doesn't fully trust DJB they found that at the last iteration of picking parameters by DJB for Curve25519 was a bit questionable.

Tell them to publish their findings and propose a better solution.

> Changes was done for "better performance" but no one found what exactly was speeded up.

What "changes" exactly? The word "changes" implies there was an early draft with vastly different parameters.

> I don't know details, but when curve parameters was tried to be being compromised by NSA was almost always was about adding such "performance optimizations".

If you don't know the details, try doing some research. Knowledge is healthy.

It's a stark contrast to the CFRG mailing list. (At least, so far, no one has tried to derail discussion here with "hey check out my custom cipher it's soooo secure but you need to compress the data before encrypting it or else you can observe a repeated structure out of it".)

I like 25519's school of thought. If you use the smallest possible value for a given performance/security goal, there's less room for conspiracy theory (provided the person making the theory understands what's even going on).

https://archive.is/exvT2

Yelp: "You're fired." (Good luck paying rent without a job.)

Yelp CEO: "The cost of living is too high here, so we're going to instead move offices to Arizona and pay the same wage."

Does this mean that Yelp is going to...

    a. Help all of its employees move to AZ where they can enjoy
       a lower cost of living?
    b. Fire all of its employees and hire replacements in AZ?
    c. Something else?

The cost of living in SF is one of the reasons I refuse to ever move there for work, but it seems like a scapegoat in this case. Why not just pay your employees a livable wage to begin with?

https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...

If a secure product could be as user-friendly as Cryptocat was while still being secure, then most peoples' communications would be more secure.

That's all I was saying. I'm not trying at all to hand-wave the proven insecurity. I'm saying that the only thing they got right was the one thing that secure products have consistently gotten wrong. (Barring Signal.)

> Security at the expense of usability comes at the expense of security.

It got the usability part down, it just wasn't secure. And I wasn't claiming it was.

I hope that not only will this new product of his be developed with "A pure vision of democratized, pleasant secure messaging", but also that he has matured significantly. I hope that Cryptocat v3 will come out after it has been thoroughly audited by several reputable third parties.

Most importantly, I hope their crypto is boring.

https://security.stackexchange.com/questions/6095/xkcd-936-s...

http://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf