Contents: One (1) Darren @darrenpmeyer@infosec.exchange

It is proven! I am calcifer on Keybase: https://keybase.io/calcifer/sigchain#a702c903fbb1f7b53572bd44e1fd89837bbb184853056b08fd9b9ee747a327150f

It's an absolute travesty we had to get here. Cops, by all indications, straight up murdering another black man. And then proceeding to gas and pepper spray peaceful protesters. And then acting surprised when those protesters, realizing they'll be punished regardless, felt compelled to riot to make their point.

But the reaction from leaders is at least a silver lining here. They're saying the right things, finally. Here's hoping it turns into meaningful change

Everything is remote at the moment, but both spots can be remote forever

Hey, Veracode is hiring some security engineers; a Senior Security Engineer and a Principal Cloud Security Engineer (AWS mainly). If you're on the hunt, check it out. If you have questions about the org, feel free to ask; I have no worries about honest answers

Sr. Sec Eng: https://www.veracode.com/job-post?gh_jid=4738852002

Principal Cloud Sec Eng: https://www.veracode.com/job-post?gh_jid=4738818002

Is there a CWE for "missed the point of the control entirely"?

LOL of the day: "you have to send us this XML file whose contents match the following MD5 Sum"

Hm, I guess I'll have to figure out where I can safely pad the file to force the collision, right?

No! I can put the given MD5 digest in an <MD5> XML element and it's accepted as valid regardless of the actual file contents!

Today's accomplishement: unattended Okta login using stored creds and TOTP secret. So many things I can automate now!

This may be the best food review ever (for a plant based chicken nugget substitute)

I may be in the minority here, but I'm actually happy that so many conferences will be virtual this year. I wish it didn't have to come at the cost of people who like in-person stuff missing out, but I hope the experiment leads to more deliberately-virtual cons

I have my technical gripes about JavaScript, but my main complaint in practice is social: when you put JavaScript on your page, you're passing a cost (in the form of compute power, which is wear and energy use) to me

If you do this, it should benefit *me* more than you. I'd bet 98% of JS that pushes to my browser benefits the operator much more than me.