#security is hard

[daily-devops]

Most of the problems with my software have come from people not understanding, or not willing to understand how GPG works, and who like to just stand in the middle of the room caterwauling for their mothers 'cos it's just too hard.  Once a little understandability sauce has been poured over the problem (basically, me reading aloud the contents of the README) the problems go away.  I don't think there has been a time yet where there was an actual bug with it. And no, GPG key problems are not bugs.

[middlemanagementlivingthedream]

Managed 365

I was going to have a fun, wistful, thoughtful post about having this job a whole year already today, but my security badge stopped working and the security team has a full stock of IDGAF so that's where things are right now. For context, every floor requires a badge to enter & exit. And the bathrooms are outside the secure areas. Good luck everyone else.

[cuyguy]

Somebody at Yahoo forgot about certificate management.

[remoun]

This site hosts material and references on our research on Cloak and Dagger, new Android UI attacks

Sheiße.

[dieswaytoofast]

Security Is Hard - Part the Millionth aka: "You got #OAuth2 right, but screwed up your trust vectors" “The root cause of this vulnerability is a common, but misplaced trust in the authenticating information received by the 3rd party app’s backend server from its own client-side mobile app, which in turn, relies on potentially tampered information obtained from the client-side mobile app"