• 13 Posts
  • 29 Comments
Joined 1 year ago
cake
Cake day: June 16th, 2023

help-circle






  • Any advice on requirements to have a shot at appsec jobs?

    I have my sec+ and my job is devops. We do everything in AWS (no on prem at all). However I have no actual cyber experience. Our team is pretty small, so I do as much dev as anyone else and as much ops as anyone else (deploying/managing cloud infrastructure), including standard security stuff like IAM and network configuration. It’s also a small unknown company.

    Is this enough to try and directly break into appsec, or do I need to start with another “cyber” role like SOC analyst or security engineer or something like that? I also plan on getting my OSCP at some point soon if that’s relevant.








  • I don’t care about XMPP as a protocol versus some other messaging protocol much, but I care a fair bit about the wdespread adoption of federated XMPP

    I don’t quite understand what this means, could you elaborate?

    if this service using this protocol becomes very popular, will the service seek to eliminate the open role of the protocol

    That is a valid concern, though the point of the article is to try and convince people why it won’t happen like it did with Google or might with Meta for structural reasons (rather than “oh but we’re different” reasons).

    The main difference I see with Snikket vs Google Talk is that Snikket is not only libre client software, but libre server software as well. The point of Snikket is that individual people host it themselves, not that the Snikket devs run a bunch of Snikket servers which require their Snikket client for connection and just so happen to use xmpp to power it. Really all Snikket is (right now) is a prosody server with some pre-configurations and easy install, as well as an android/ios app which are general xmpp clients that are designed to work well when connected with Snikket servers.

    Now it could still go south in a similar way to Google Talk, in that maybe a bunch of people start running Snikket servers and using Snikket clients, and then the Snikket devs start wall gardening the implementation. That would be bad, but the users (both server runners and client users) would be in a much stronger position to pivot away from those decisions.

    I think it’s at least an interesting idea (hence why I posted it) for the reasons the author mentions: striking a balance between trustless freedom and interface stability/agility.


  • That sounds roughly correct, though I don’t see the connection with the article? Unless you’re saying that “products” (like Signal) will always exist, which is probably true but is orthogonal to whether or not other models will succeed.

    As for email, I think posteo does a pretty good job, but you’re right options are few and far between. But self hosting email is just as viable as ever? Perhaps less so since e.g. gmail will instantly flag your incoming mail as spam if you’re sending it from randomsite.tld, but honestly that issue hasn’t gotten that bad (yet). Yes, whenever there’s a protocol like email or xmpp, companies will create gmails and signals and turn them into walled gardens, but that doesn’t spoil the protocol for everyone else. It just causes frustration that companies build closed products on top of open technologies, but not much to be done about that.





  • mrh@mander.xyzOPtoUnixporn@lemmy.ml[OC] GNU/LiSP
    link
    fedilink
    English
    arrow-up
    4
    ·
    8 months ago

    Yep! If you’re applying and need a non-trivial number of locations checked/maps generated, you can check out the prgoram here.

    Note that it says you can install it with guix, but it hasn’t actually been merged into master yet, so for now you do need sbcl and the dependencies (etiher via quicklisp or however else you snag them).





  • I agree “cloud native” is not great, I won’t be using that term.

    Why are cli tools generally not available as flatpaks? There’s nothing about how flatpak works afaik which distinguishes gui and cli. I get that the original motivation for flatpak was guis, but considering how long it’s been touted as a “universal” package manager for linux, I don’t understand how there could be so few clis.

    I’ve heard people say the name for packages from flathub is awkward (which it is), and aliasing everything you install would be annoying (which it would), but that sounds like such a simple problem to solve.

    I’ve also heard people say that flatpak clis would be useless because clis tend to be systadmin tools, and thus need to be not sandboxed. But this strikes me as a non sequitur. Gui tools can be used for sysadmin, and there are tons of cli tools which have nothing to do with sysadmin, they’re just userspace programs.

    What does your workflow look like with toolbox/distrobox?