Securosis
securosis.com · Group blog · on HN since 2008
Securosis is an information security research firm whose analysts write about cloud security, Apple security features, and industry practice.
What HN saysHN links it for technical security explainers on iMessage, Gatekeeper, NoSQL injection and cloud billing; commenters cite it to support points in discussions.
23HN people shared it
6linked it in comments
21stories submitted
34story points
5 years agolast shared
2008people per year2026
Most-shared posts
- 1How iMessage distributes security to block “phantom devices”3 people · 4 points · first shared 2016 · discussion on HN
- 2My $500 Cloud Security Screwup2 people · 2 points · first shared 2014 · discussion on HN
- 3From Blackhat: NoSQL and No Security2 people · 2 points · first shared 2011 · 2 comments on HN
- 4Do We Have a Right to Security?2 people · 1 points · first shared 2016 · discussion on HN
- 5Defining the Journey–The Four Cloud Adoption Patterns1 people · 3 points · first shared 2021 · discussion on HN
- 6Defending Data on iOS 71 people · 2 points · first shared 2014 · discussion on HN
- 7How to use the 2013 Verizon Data Breach Investigations Report1 people · 2 points · first shared 2013 · discussion on HN
- 8Massive, Coordinated Patch To the DNS Released1 people · 2 points · first shared 2008 · discussion on HN
- 9Investigating Touch ID and the Secure Enclave1 people · 2 points · first shared 2013 · discussion on HN
- 10Defending Data In iOS 71 people · 2 points · first shared 2014 · discussion on HN
- 11Thoughts on Apple’s Bug Bounty Program1 people · 2 points · first shared 2016 · discussion on HN
- 12How iMessage distributes security to block “phantom devices”1 people · 2 points · first shared 2016 · discussion on HN
- 13Mountain Lion Gatekeeper in Depth1 people · 2 points · first shared 2012 · discussion on HN
- 14Hacking Spikes and the Real Time Media1 people · 1 points · first shared 2011 · discussion on HN
- 15Ranum’s Right, for the Wrong Reasons1 people · 1 points · first shared 2010 · discussion on HN
What HN people wrote when they linked it
BrandonM · 2014-03-29
This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches.
I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good examples to share?
[0] https://securosis.com/blog/my-500-cloud-security-screwup and http://vertis.io/2013/12/17/an-update-on-my-aws-bill.html are two examples.
moopark · 2011-01-18
When Mac OS X updates the signature on a binary (for instance, when you configure a firewall rule for a previously unsigned binary), the actual Mach-O file will be changed -- and your digest will be incorrect.
Skype (which has notoriously complex obfuscation) had this problem for a short time when Mac OS X 10.5 was released:
http://securosis.com/blog/leopard-firewall-code-signing-breaks-skype-a…
You can work around this by validating only the important subset of the Mach-O contents, but it's probably not worth it. Cracked applications (rather than, say, reverse engineered serial number generators) are an annoying thing to use -- you'll have to refrain from applying updates until you get a new crack, trust the person distributing the crack, etc.
It's not something I (or, afaik, most other small Mac developers) really worry about.
Spearchucker · 2014-05-13
Many devs I speak and work with are either ambivalent or disillusioned about agile. In my circles this article keeps coming up in discussions about agile - https://securosis.com/blog/agile-development-and-security/.
zoowar · 2011-08-11
Server-Side JavaScript Injection: Attacking NoSQL and Node.js https://securosis.com/blog/nosql-and-no-security
billswift · 2010-12-01
Here's a good reply http://securosis.com/blog/ranums-right-for-the-wrong-reasons
mythz · 2016-02-23
> "They are not asking for some general thing, they are asking for a particular case."
Was hoping Gates would be less naive in thinking this legal precedent has anything to do with this specific case which has close to 0% chance of providing any real-world information and more to do with the fact that this tragedy is used as political theatre and being exploited for maximum PR and political influence.
> "Should governments be able to access information at all or should they be blind, that's essentially what we are talking about"
That's one way to frame the debate, the other is "Do We Have a Right to Security?" https://securosis.com/blog/do-we-have-a-right-to-security
Given the US Govt is coming from a position of no trust who've shown a willingness to over reach and break the law whilst continuing to deceive and mislead the public - US citizens have every right to privacy that's insulated from the Government: http://blog.easydns.org/2016/02/22/the-us-government-has-no-credibilit…