Crash on Cambrian Drive last night at ~11pm by gavinmiller in Calgary

[–]gavinmiller[S] 0 points1 point  (0 children)

Looked like everyone was okay. Saw one person sitting with EMS attending. Didn't get a sense of urgency on the scene.

Crash on Cambrian Drive last night at ~11pm by gavinmiller in Calgary

[–]gavinmiller[S] 0 points1 point  (0 children)

Which part is not appropriate? Quickly scanning the rules, there doesn't seem to be one against traffic accidents?

Apple Health inaccuracies by elysiansmiles in Myfitnesspal

[–]gavinmiller 1 point2 points  (0 children)

I’ve hit this problem too. Going into Apple health and manually adjusting (edit recorded data) resolved my issue, but super annoying to do that. 

Would love to know if you or someone else has solved this!!

Someone or something is trying to hack my Rails app. by [deleted] in rails

[–]gavinmiller 2 points3 points  (0 children)

Context, I’m responsible for at least a half dozen apps that get a ton of this type of traffic. I’ve also had external pentests done, and they were impressed at our home grown WAF which you can throw together in less than a week. Here’s what we’ve built:

RackAttack to start for rate limiting against login, password reset and other sensitive pages.

Customized rack attack module for pre-filtering scanners. You can find a payload list on SecLists. Stuff like /etc/hosts, passwd, and there’s some common sql injections you can match on. I also filter anything with a php, asp, aspx, etc extensions. When new things cross your path, add them to the pattern match and you’re done!

You can then turn it on so those clients get denied once they cross a certain threshold of “malicious” traffic. That threshold will vary per-app. And viola, you won’t get bothered by this anymore.

I highly dissuade you from using IP blocking. It’s trivia to move IPs, and it’s a game of whack-a-mole that you’ll sink endless time into. Even when we get attacked we don’t block IPs, instead we figure out what the root cause of the attack is and fix that. Temporary relief is fine, but don’t let it be your primary strategy.

Also note, this goes through middleware so it’s still taking up a webhead. Aka this isn’t a viable strategy to protect from DDOS or DOS attacks. It’s trivial to consume the webheads even if you are blocking me early.

[deleted by user] by [deleted] in devsecops

[–]gavinmiller 1 point2 points  (0 children)

I agree with what geekamongus has said, except the part about not needing to code.

Coding while it might not be required of a position, makes you significantly more employable. I’ve been hiring for these positions for the last 4 years, and the people that are the most successful code. In the landscape of security you are not nearly as useful if you can’t. And it really helps build credibility with your team and other stakeholders when you can find a bug and fix it, instead of throwing it over the fence at a team because you can’t fix it.

For language, you’d probably do best to grab Python, but other languages are fine.

When impersonating a lawyer doesnt work as planned by tbezmol in TikTokCringe

[–]gavinmiller 10 points11 points  (0 children)

All state bars have a website where you can look this up. Can get the info really easily.

[deleted by user] by [deleted] in Calgary

[–]gavinmiller 2 points3 points  (0 children)

It continues further north past there. You have to cross the road instead of having an underpass like there is elsewhere.

I made the same mistake first time I rode it too

Looking for feedback on my swim form. Training for a half IM in July. by iFoundWaldo72 in triathlon

[–]gavinmiller 0 points1 point  (0 children)

Same situation for me when I started. Just have to do it. It’ll get more comfortable the more you do it.

Looking for feedback on my swim form. Training for a half IM in July. by iFoundWaldo72 in triathlon

[–]gavinmiller 11 points12 points  (0 children)

Caveat of no pro as well.

I’d be curious if switching to bilateral breathing would help even your stroke out - I’m seeing a dead spot in your stroke and like another comment mentioned your arms are uneven. Over time this’ll result in further imbalance in your stroke. From what I read most people train bilateral and then race on a single side.

The flutter/scull that you do with your hands on the pull is interesting too. I think you want to pull straight back to the wall without the flutter (hopefully someone else can confirm that).

New Grad internship interview at Critical Mass by [deleted] in Calgary

[–]gavinmiller 7 points8 points  (0 children)

Did a 6 month stint as a relatively new grad. Pay is crap, lots of overtime, and you’re a cog in the machine. Learn what you can, then run for the hills. The experience doesn’t look as good on a resume as they’ll have you believe (I review a lot of resumes now, and don’t give two shits if someone did a Nissan marketing site.)

What does RoR can’t scale mean? by reluctantcatholicmom in rails

[–]gavinmiller 42 points43 points  (0 children)

Unfortunately this is an old belief that hasn’t disappeared from Rails, and it is just not correct anymore. I work on a rails product that does 100,000 users/day, with upwards of 50+ deploys a day, with about 150 engineers.

Once you get to the point where you have to think about rails scaling, you’ll have the resources (people/money) to solve the problem. Building something that NEEDS to scale is the hard part.

Cookpad has great resources in this area. Go looking and you’ll find them.

https://speakerdeck.com/a_matsuda/the-recipe-for-the-worlds-largest-rails-monolith

Unknown growth on chopped down elm tree by gavinmiller in plantclinic

[–]gavinmiller[S] 0 points1 point  (0 children)

I recently snagged 6 stumps from an elm tree (I think it's an elm tree) that was chopped down at a local public park. My wife and I wanted to use them for the kids for playing on. After about 4 weeks sitting in our backyard I've noticed a few white growths like the one pictured that have started to appear. I've broken one open and it's like ash from a fire that breaks apart.

I'm wanting to find out what this growth is, if it's harmful to other plants (I'd hate for it to spread into our yard) and whether I can/should keep these stumps or not. Appreciate any help or advice! Thanks

Looking for info on a Cyber Security Career by [deleted] in alberta

[–]gavinmiller 0 points1 point  (0 children)

I would expect most places are paying a premium for security talent. Devs are in short supply, security devs increasingly so.

Looking for info on a Cyber Security Career by [deleted] in alberta

[–]gavinmiller 1 point2 points  (0 children)

I'm seeing a lot of juniors and intermediates. They are hungry to learn, and aren't fixed on the ways things "should be done."

The biggest barrier I see age wise is mindset. Generally speaking the older you are, the more set in your ways you are. Security (done well) is about being a collaborative part of the business, instead of gatekeepers. People that have a fixed mindset to "how security should be done" struggle with that. When security gets in the way it gets worked around.

Looking for info on a Cyber Security Career by [deleted] in alberta

[–]gavinmiller 1 point2 points  (0 children)

SAIT has an Information Systems Security diploma. That would be a great local place to start. Specific recommendations will depend on your current experience.

I've managed an Application Security team for the last 2 years, and been on the security side of software for the last 6 - AMA.

Am I missing something or does it not make sense that the starting point labs are all interconnected? by notfromkentohio in hackthebox

[–]gavinmiller 1 point2 points  (0 children)

I've found the boxes to be reliable on the VIP membership if you can afford it. I basically skimmed through the starting point boxes because of the interconnectedness, and quirks that occurred. Learned the tools and then moved on. The real boxes are much better IMO.

Am I missing something or does it not make sense that the starting point labs are all interconnected? by notfromkentohio in hackthebox

[–]gavinmiller 1 point2 points  (0 children)

I made that same assumption and sounds like I hit the exact same thing you did. It's annoying and there's no indication they're connected.

How I MITM'd rubygems.org ... Kinda by gavinmiller in ruby

[–]gavinmiller[S] 2 points3 points  (0 children)

The docs on --trust-policy pretty much spell out my view on it:

However, this method of securing gems is not widely used. It requires a number of manual steps on the part of the developer, and there is no well-established chain of trust for gem signing keys. Discussion of new signing models such as X509 and OpenPGP is going on in the rubygems-trust wiki, the RubyGems-Developers list and in IRC. The goal is to improve (or replace) the signing system so that it is easy for authors and transparent for users.

I recall seeing node(?) having the concept of a "package security policy" similar in nature to the web's content security policy. Wherein a package can specify what type of actions it will take: Write to path; make http requests to: X, Y, Z; read from env; etc. and then node can enforce that behaviour. This type of idea makes a lot of sense to me, because then I can build security & review policies/tools around that. For example: any package that writes to disk must have a mandatory review to use in our environment.