| Bose SoundTouch systems were introduced into the market in 2013. Technology has evolved since then and we’re no longer able to sustain the development and support of the cloud infrastructure that powers this older generation of products. We remain committed to creating new listening experiences for our customers built on modern technologies.
I used to live in France. We had no A/C, enough climate consciousness not install it, though our east-facing windows were bringing important heat at sunrise. We had awnings installed, with an HomeKit connection, so we could automatically have them closed before sunrise, and opened once the sun would leave this face of the building. We saved a few degrees in this way.
PyMiniRacer (original) author here. PyMiniRacer is definitely a way to run insecure code, but as pointed, the several CVEs in V8 require measures beyond "just" relying on PyMiniRacer to make it safe.
1. Total control over what APIs the user's code can call: you kinda got it... users can just do plain JS
2. Memory limits: you got it
3. Time limits: you got it, but the current model is unreliable when used at high levels of CPU and a high number of threads.
And thank you so much bpcreech for taking back the ownership of PyMiniRacer!
I built a tool to extract ROP gadgets from binaries [0], which got noticed by a guy at Apple, and I ended up spending 4 years there.
And this guy became Sqreen CEO and my (incredibly awesome) cofounder.
What if this isn’t a good news for 99% of Apple users?
That’s obviously an amazing measure for the 1% high targets out there.
But what about the other 99%? Does that create an incentive for Apple to strengthen Lockdown Mode security to the detriment of the regular mode (should we call it Unsafe Mode)?
I’m afraid that this architecture will make it harder to prioritize security features or fixes for the 99% users. Developers bandwidth is limited, they can’t fix all bugs. Hence if you have to choose between one bug impacting the 1% most important users (from a security standpoint) versus one bug impacting the 99% others, which would you choose?
Would such an architecture have led to the emergence of Blastdoor[1] - which attempts at mitigating iMessage attachement exploits, but is now useless in Lockdown mode?
My hope here is that by reducing attack surface, Lockdown mode will make exploits much easier to fix (as they’ll target a limited area), allowing to strengthen the system core while freeing bandwidth to implement longer term, Blastdoor like mitigations.
I’m Sqreen CTO and co-founder, now working on building AppSec at Datadog.
You can keep using Sqreen as we’re maintaining the service for at least a year. Right now we are focused on integrating Sqreen capabilities to Datadog, so you will be able to migrate at some point!
Stay tuned for that, and please get in touch (https://twitter.com/jbaviat ) if you’d like to be a design partner.
Sqreen | YC W18 | Data Engineer | Paris | Full-Time | Remote |
Sqreen | YC W18 | Agent Principal Engineer | Paris | Full-Time | Remote |
Sqreen | YC W18 | Principal Engineer, Platform Squad | Paris | Full-Time | Remote|
Sqreen (YC W18) is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. What Application Performance Management tools (like New Relic) do, but for security.
We are currently looking to fill a few critical roles in a European friendly timezone (+/- 2 hours) for our Product & Engineering team:
Product Security Engineer - a software engineer with a security focus who will help to secure our products for our customers.
Data Engineer - a backend engineer who is passionate about all things data processing, platform availability & performance and scalability.
Agent Principal Engineer - a technical lead who will be responsible for driving the overall technical vision across our entire agent library (7 languages and counting!).
Principal Engineer, Platform Squad - a technical lead who loves technical strategy, mentoring and anything architecture related.
All of these roles are open to full remote with a European compatible time zone.
Sqreen (YC W18) is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. Pretty much what an Application Performance Management tool (like New Relic) is doing, but for security.
We are currently looking for Java agent engineers (e.g. you need to love byte code instrumentation [1]) and C/C++ [3] [4] [5] (remote anywhere in European timezone) to help us expand the capability of our agents, as well as a senior level Backend developer (knowledgeable or willing to learn Python) to build new functionality on our backend (based in our Paris HQ).
Also, we're looking to hire a Cross Agent Engineer in Paris too!
Sqreen (YC W18) is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. Pretty much what an Application Performance Management tool (like New Relic) is doing, but for security.
We are currently looking for low-level Java (e.g. byte code instrumentation) and C/C++ developers to help us expand the capability of our agents, as well as backend developers (knowledgeable or willing to learn Python) to build new functionality on our backend.
Also, we're looking to hire our first Product Manager to define & work with the squads to keep delivering more value to our users.
You are correct, our content security policy is not perfect, and we are gradually improving it. Security is a journey and there is no such thing as perfect security. We are striving to incrementally improve everything we are doing as our team is scaling.
Let's assume I'm using Python 3.6. All my calls to os.urandom (such as uuid.uuid4) can block if my system's entropy goes down.
Let's assume as an attacker, I can reduce the system's entropy up to making all calls to e.g. uuid.uuid4 blocking, potentially making my Python blocking everythime.
That’s also close to the YC motto: “make something people want”.
Or as Paul Graham puts it: be good. https://paulgraham.com/good.html