bradleyjkemp

If you compromise an employee at a mature, well-secured enterprise, what do you get?

How do you hire your startup’s first security engineer?

I’ve built and maintained countless “janitor” systems in my career: cronjobs which go and clean up old resources like user accounts which should no longer be active.

Yes, I’ve made the classic mistake and re-started a writing habit by fiddling with the technology.

People expect companies/services to tell them when untoward things could be happening to their accounts: Their account has logged in on a new device Their password has been changed An export of their data was started These examples are things you should p…

I once got a debit card with the CVC number 000.

LaunchDaemon (or LaunchAgent) Hijacking is a MacOS privilege escalation and persistence technique.

You’d expect phishing sites to be hard to detect and track, but actually, many of them contain HTML fragments that uniquely identify them.

A/B testing is a lifesaver for a solo SaaS developer.

Nobody likes alerts that feel like a waste of time to review.

Making users more secure generally means annoying them.

Intrusion detection honeypots are just plain cool.

Snapshot testing is an extremely fast way to add regression testing to an existing project.