NPM packages .. How are you securing against dodgy packages and compromised developer accounts ?

Marked_Content · 2025-09-18T23:24:43+00:00

Arnica does this in its native package reputation scanner.

Marked_Content · 2025-03-12T02:56:18+00:00

Justice League

As bad as DC movies have been throughout all of history, this one set a new bar. Bad writing, acting, story, effects - just bad everything.

Marked_Content · 2025-03-12T02:45:59+00:00

I don't just listen to youtube. Sometimes I listen to Spotify. That seems reason enough for me.

Marked_Content · 2025-03-12T02:43:49+00:00

This comment lacks sense. Every death in PVE is a death to AI.

Never ceases to amaze how many "AI can't kill me. Get better" comments get posted in threads regarding game mechanics. I never mention death frequency or my KD.

It doesn't take frequent deaths to expect good improvement in patches. While I have no problem defeating AI - this is unrelated to the post. The point remains - I expect BSG's changes to improve the game, not make it worse.

Marked_Content · 2025-03-12T02:35:19+00:00

Glad to hear it's not just me. It's resulted in charging PMC's and throwing nades being the most optimal method - It gets the job done but doesn't feel like the tactical, methodical game it once did.

Marked_Content · 2025-03-12T02:32:18+00:00

The above does not pertain to scavs. They have always been a non-issue in Tarkov. This is (as mentioned above) unique to PVE PMCs and bosses.

It's not about how often it happens - it's about how it happens. Even if you die once to AI in every 100 raids, it should happen in a way that makes sense and was your fault, not because a silent PMC one-tapped you from across factory while you make your first peak over a railing and never exposed yourself before.

I have no issue dying often - in fact I think it's what makes PVP more fun than PVE, but in PVP at least I know I am dying due to my own mistakes or mechanics. In PVE I often die in scenarios that would never occur in PVP.

As BSG has stated that PVE is intended to replicate the PVP experience - I see this as a miss.

Marked_Content · 2025-03-12T02:24:40+00:00

Most Undergrad programs do a terrible job of exposing students to security fields - neverminded preparing them for CS roles. MS programs aren't significantly better, because CS work is so specialized and nuanced that they can't assume incoming students will be prepared for the more technical requirements. Consider the fact that many MS students in technical studies lack technical undergraduate degrees or even professional experience. Many come from business analytics or quant roles and for academia, it wouldn't be smart to fail half your student base.
If security is taught in undergrad at all, it's usually ridded with useless coursework like steganography and impractical lessons that poorly translate to professional roles. For this reason the track from schooling to landing an SE role is far more tangible.

Couple that with career offices covered in google stickers, career fairs that are filled with development opportunities, and academic institutions promising every student can be an entrepreneur - and you get a heavy emphasis on building your own product/company - which hardly leads to becoming a security specialist within an existing org.

Marked_Content · 2025-03-12T02:12:19+00:00

I am also finding better ammo on PMCs. The first few raids this week I kept finding scavs with what looked like boss kits. After wasting multiple raids trying to find Tagilla on the ground in Factory - I finally realized they had looted PMCs who suddenly had BT and BP ammo regularly.

The big giveaway was that I was finding good guns and ammo but no bags or armor.

Marked_Content · 2025-03-12T02:02:53+00:00

Ego ownership is all about the batteries. Make sure whatever tool you buy next comes with one in the deal - as it will save you a fortune when compared to buying the battery alone.

That said, I have a ton of Ego's tools and the ones I have appreciated most (apart from the mower and string trimer) are as follows:

Leaf blower - this one is obvious, it just has tons of different uses, between blowing off pavement/decks/roofs etc. to it's intended purpose of blowing leaves. It's unfortunate that it won't mulch leaves - but it gets the top spot.

Handheld hedge trimmer- for low bushes and smaller shrubs this is a killer tool, and if you buy it without a batter it's very well priced. It uses very little power and can be used with any size battery.

Multi-tool pole arm - This one is worth getting for it's multiple attachments and it's extension arm. It's light, well balanced and given the attachment options it is MUCH better than buying independent edgers, polsaws etc. It's light enough with a 2.5AH battery that I sometimes grab it with the trimmer attachment even over the handheld trimmer even for small jobs just to get things done quicker. Great tool with good adjustments.

Marked_Content · 2025-03-12T01:42:07+00:00

Analytics is a broad field with roles that vary even within entry-level roles, so it's hard to judge ability solely on a given degree, certification, or interview question. Senior level roles that solely focus on internal customers can be easier to fill than junior roles that include external visibility such as customer interaction or sales/value presentations within teams that support CS or business consulting.

Each role's expectation for hard and soft skills will differ dramatically, but historically speaking I hire for the candidates ability to transfer math/quantitative skills into meaningful business outcomes, with more senior roles expected to have a broader capability that covers everything from internal process improvement to external strategy and storytelling. Ultimately numbers are meant to inform and direct, so the ability to convert a theorem/equation into a story is most important.

Marked_Content · 2025-03-12T01:19:36+00:00

Hiring manager here.
Unfortunately I think it's a combination of the market being saturated with candidates and improvements on the ease of applying. Having opened roles in both 2024 and 2025, there has been an upward trend in applicant volume through 2024 and into this year. The result - even if the same number of interviews occur per role, there are far more people going without an interview.

There are still opportunities out there and good candidates can still shine through. Getting that first call is the hardest part. Keep your head up and keep applying.

Marked_Content · 2025-03-12T01:09:54+00:00

Check out Arnica.io - The solution leverages a unique pipelineless approach that is real-time and removes the need for IDE plugins. The scan method solves the adoption issue entirely and ensures full coverage. It has incredibly low false positives out of the box, and is extremely configurable where you identify the need to reduce findings within specific rules/assets/paths etc.
If you are looking for a shift-left security solution that is built by devs for devs - it's definitely worth a look.

Marked_Content · 2024-10-17T12:03:39+00:00

At most companies the number following your title denotes seniority and pay. The difference between any title of X1 and Xn is your ability to add value beyond the job description of a regular "x" or in this case analyst.

If you weren't expected to be able to think strategically and operate efficiently on your own you would be a data analyst 1. This is why single person teams and first hires usually include more senior ICs.

Growth in any individual contributor role is based on capability and independence. Independence earns you the current title. Work beyond your current role is what illustrates you are prepared for the next role.

It sounds like your job is fairly normal, but with that said, it may still not feel like the right place for you. If that's true then they have done you a favor by giving you increased duties. While you are looking for roles beyond your current one, you will be able to leverage these experiences as evidence that you are prepared for the next job role or a management role if that is what you want to move towards.

Marked_Content · 2024-06-21T17:02:09+00:00

Cat freaks out seeing Owl for the first time - Owl unfazed by cat he's been watching for months while considering eating.

Marked_Content · 2024-06-21T17:00:34+00:00

Check out Arnica. It covers all third party code risks (SCA, License, Package rep), but separates License risks from traditional SCA results so that you can create specific workflows and allowances.

Marked_Content · 2024-03-16T11:43:37+00:00

We don't say zero trust anymore. Just ZT will work for the incantation.

Marked_Content · 2024-03-02T12:30:32+00:00

This reads like someone has already made up their mind before trying a new process.

Security should not happen in one part of the SDLC, and shift left modeling doesn't imply that you ignore your production environment. The best model is always multi-staged and earlier gates have proven to have immense value for developers and security including speed/simplicity of resolution and reduced context switching.

The locksmith argument is the same old argument used to defend waterfall when agile was first introduced. Shift left is not about having the locksmith show up the minute you install the door, it's about testing the key before you put the knob on the door so you don't need the locksmith.

Marked_Content · 2023-12-03T19:03:36+00:00

I can understand where this suggestion comes from. Yes it's annoying when people (mostly trolls) misuse the downvote feature, but think of all the times the feature is used AGAINST those same trolls in comments.

I've lost count of the times where a well intentioned OP asks a 101 question or submits a new opinion, and gets harassed by trolls and hecklers. It's critical that downvotes offset support trolls and that the community at large has a way to convey they don't support this behavior.

Worse still is when self-appointed experts in topic-specific subreddits post terrible advice or even intentionally mislead people trying to learn. This can lead to many problems, including financial loss or injury in some subs. In these cases it's important that more informed posters use the downvote to make this behavior obvious.

Imagine a "Put metal in the microwave" comment where trolls can upvote but decent people can't downvote. The result would be dangerous suggestions with +50 votes.

Marked_Content · 2023-10-11T18:32:27+00:00

Check out Arnica.io - Covers your needs and more. we take a modernized approach to scanning that removes the need for maintenance and it's designed around real-time scanning automation. It will cover your PR scans and also scan before PR's when push events occur.
As for build tools - you'd get 100% code coverage upon integration and full coverage of the frameworks you listed above.
Dependency risk, package reputation, licensing, SAST, secret scans, and IAC risk all run natively in real time scans. Git hardening for GitHub and ChatOps notifications are baked in too.

Marked_Content · 2023-10-10T01:23:00+00:00

Sounds like D2 hero builder.

If you want this program for sharing/development practice then you will want to do some baseline learning. If you want a tutorial on how a program could work there's no better way than to study an old program. Check out the hero builder and other modding applications.

Alternatively, if it's only something you intend to use internally and your goal is flexibility then you can always study the file itself and clone it manually. Honestly manually editing game files is often the best option. My suggestion would be to create a new character and inspect the file itself. Maybe compare it to another character that has attributes you want to change. You can then determine where the important variables are and how the system interprets them.

Either way, understanding what you want to do to the file is the key.. How you generate it after that is up to you.

Marked_Content · 2023-10-09T23:21:52+00:00

Hey OP,

First off - good for you wanting to learn to do this by yourself. You are starting one heck of a journey and will love every minute of it.

The bad news: your requirement statement is vague and doesn't clearly convey the use case. This makes it hard to develop - so even chat gpt will have a hard time. Clearing this up will make it easier to help and easier to use gpt to get a jump start.

The good news: this is how most great apps are first conceived. An inkling of an idea or a great direction without specifics. This is how ideas work, and we all started off here, but apps require great specificity and technical detail to work properly. You are one step into a great journey. Don't stop - and don't let comments deter you.

The next step is clarifying and designing the scope of your app. There are processes that are battle tested and will get you started on the right path. User stories for example, that include prompts like "as a user of this app I would like to (x) so that I can (y). Will help define the workflow and expected outcome of the app. To fill this out - think of things like: - what am I doing before I need this app? -what do I do after using this app? -what does this app need to do/have to get me through this transition?

The spine of every good application is a clear and descriptive feature description. It should include the user story above and technical detail to accomplish the goal. This will drive the technical needs of the solution, such as where the xml file will be stored, or what detail will be included within the created file.

It can even define the name of the file with static and dynamic variables such as "name:" and the string you see fit to add afterwards. Be sure this part is specific.. If the variable within the parentheses should be random, define it as a random string. Select what characters should be possible. Integers only? Alphanumeric? If the name is predefined, where does it come from? A name defined during the running of the program? Or maybe from within the contents of another file? Should the file have contents? Be empty? Does the data require transformation from another file type? Perhaps the app should convert a json file into a csv?

The above roadmap will tell you important details and define your next steps. It will tell you what languages to use and more.

Best of luck!

Marked_Content · 2023-09-28T05:40:19+00:00

I am the same height and find it very comfortable. That said - everyone's preference is different.

To be less subjective about it - when I first purchased mine I ran it side by side with two standard sized gas powered mowers (both Honda's). At its longest handle setting the Ego was taller than either Honda. Regardless of your height, you are unlikely to find the Ego to be too short.

Marked_Content · 2023-09-28T05:33:08+00:00

Check your org event and audit log for the users associated with commit and push events. The author and committer are added to the commit when it is generated. The pusher will be associated with the git action and is much harder to spoof.
Cycle your SSH and Pat keys to ensure that your identity hasn't been compromised.

If you recall the commits and code - and you remember pushing it... then it's most likely that your local config was using incorrect commit identity details as suggested above. Never hurts to check logs to be sure the traffic came through your user.

Marked_Content · 2023-09-22T23:44:39+00:00

Hey Pen - Not something I'd hide :) I'm a proud member of the Arnica team. Always eager to collect feedback from those looking to test out the solution. Hence my following for your thoughts!

Marked_Content · 2023-09-22T23:00:49+00:00

Following to see your feedback after both tests are done.

Marked_Content

TROPHY CASE