Choosing secure open source packages

Jun. 26th, 2017 04:02 pm
terriko: (Default)
[personal profile] terriko
This is crossposted from Curiousity.ca, my personal maker blog. If you want to link to this post, please use the original link since the formatting there is usually better.

I wrote a pair of blog posts for work that came out last month!



Many developers don’t feel qualified to make security decisions. In many ways, that’s a perfectly healthy attitude to have: Security decisions are hard, and even folk with training make mistakes. But a healthy respect for a hard problem shouldn’t result in decisions that make a hard problem even harder to solve. Sometimes, we need to recognize that a lot of architectural decisions in a project are security decisions, whether we like it or not. We need to figure out how to make better choices.


The posts are about how to do very simple security risk assessments on open source packages, so you can make more informed choices about what you include in your code and get a sense of what makes a library look scary to security folk. They’ve got lots of real life examples of things we’ve seen, good, bad and embarrassing, and there’s a nice scorecard at the end that you can use to help you do quick assessments of your own. There are even some cat memes included!



I’m pretty proud to be able to share some of the things we’ve learned about open source security risk with the greater world and these posts fall in the category of “things I’ve made” so I thought I’d link them here. Hope you like them!

nanila: little and wicked (mizuno: lil naughty)
[personal profile] nanila
I’ll never understand the pride people take in saying, “I was born and bred here” or the use of the same phrase to defend one’s perceived superiority or deservingness of housing, health care or other basic human rights.

I mean, what did you, yourself, actually do to influence where you were born or bred? Unless you were a particularly ambitious embryo, the answer is “nothing”. Sure, your parents might have made some kind of effort to select your place of birth. Maybe they strove to move to better housing in a neighbourhood with better services and schools. Maybe they’re even immigrants, like my dad, and they struggled long and hard to learn their fourth language in order to integrate into their adopted country. But you? You didn’t do anything. Why are you so proud of that? Think of the things you've accomplished in your life. Isn't it far more fitting and fulfilling to be proud of those?

And why the obsession with asserting the superiority of a single identity over the others? “I’m English first and then British.” Pro-tip: Most of the rest of the world considers both of those to be synonymous with “ex-colonialist imperialist arsehole” so it doesn’t really matter which one you choose. ^.^

Here is a list of the geographically-linked identities that I consider myself able to lay claim to. I’m proud of some and not others.

  • American
  • British
  • European
  • Hawai’ian
  • Filipino
  • Olympian
  • Seattleite
  • Angeleno
  • San Diegan
  • Londoner
  • Brummie (this is a new one; still feels a little odd)


Today, I think I’m proudest of being European. I earned that identity and that passport, and I’m still very pissed off that some people want to take it away.

Today is also, weirdly, simultaneously:

  • the anniversary of Brexit, aka the Colossal Waste of Time and Money Foisted Upon Us by a Generation That Tore Down Decades of Painstakingly Won Goodwill with Our Neighbours and Won’t Live to Experience the Disastrous Consequences, Thanks a Lot, Dickheads.

    And

  • International Women in Engineering Day


So, to close this post, here is a peaceful photo of a woman doing some engineering.

Scientist at work
nanila: wrong side of the mirror (me: wrong side of the mirror)
[personal profile] nanila
I have been outrageously busy at work this week and I don't have the brain to string these together into a proper narrative. My apologies. So: Have a series of happy photos from the past week or so.

20170617_171856
[Keiki with freshly dug potatoes in his fist, ready to deposit them in one of the two white bowls in front of him.]

We ate our first potato harvest tonight. Yum!

+6 )

All the cool kids are playing Bingo

Jun. 22nd, 2017 02:11 pm
jesse_the_k: Macro photo of left eye of my mostly black border collie mutt (Default)
[personal profile] jesse_the_k
on twitter & FB...but I'd rather do it here.

I made this card at
http://myfreebingocards.com
Then I download others' cards, use a photo editor to check off shared interests, and repost.

Jesse the Kingo card

Jesse the Kingo card described )

Fads of youth

Jun. 21st, 2017 09:25 am
badgerbag: (Default)
[personal profile] badgerbag
I was thinking last night of fads. In the 70s I had an official "Pet Rock" which I loved. The manual on care and training of Pet Rocks was very amusingly written (at least to my 7 year old mind). Pet Rocks were particularly great at learning to "stay" and "play dead". It came in a little carton full of straw with the manual and I think, a leash.

My dad was a good model for how to gently enjoy human absurdity and I remember him being super entertained by the pet rock and playing along with it super well.

Somebody’s woke af.

Jun. 21st, 2017 11:01 am
nanila: wrong side of the mirror (me: wrong side of the mirror)
[personal profile] nanila
Humuhumu: “Keiki, are you a boy?”
Keiki: “No!”
Humuhumu: “Keiki, are you a girl?”
Keiki: “No!”
Humuhumu: “What are you, Keiki?”
Keiki: “I’m a KEI-KI.” syllables of name drawn out emphatically

20170620_194627
[Humuhumu and Keiki in the bath, giving themselves bubble beards.]

my political sentimentality

Jun. 20th, 2017 11:50 am
brainwane: My smiling face in front of a brick wall, May 2015. (Default)
[personal profile] brainwane
From "An Excerpt From My Definitely Not a Presidential Campaign Book" by Alexandra Petri, Washington Post, June 5, 2017:


People always ask me what I'm passionate about, and I tell them the following story: When I was a little kid, my grandmother took me to see an injustice. I got so mad! I threw my red white and blue popsicle down on the ground. My grandmother picked it up and said, "Winner, these colors are sacred. Never let them drop." And I said, "I know, Grandma, but I don't like to see injustice!" and she said, "That's just the world we live in. Unless you grow up and devise common-sense policy solutions to do something about it. And don't forget the men who died to give that right to you, and proudly stand up to defend her still today."

....

I think sex is bad unless it falls into one of the five categories below that also conveniently align with my policy proposals:

-- you are thinking about tax reform during it
-- other people are having it and you are vocally disapproving of it
-- at least one of the people involved is committed to being a great dad
-- it involves one willing participant who is a male celebrity
-- it is binding Americans together and serving to restore our common values


So one way I know that I am hopelessly sentimental about civic virtue and so on, and that part of me is an utter sucker for "common-sense policy solutions"/"binding Americans together"-type rhetoric, is that even this parody makes me mist up a little bit. Also I have literally cried (albeit on an airplane) at a Doritos ad that championed bipartisanship.

(As a young'un I came across a copy of Art Buchwald's I Never Danced at the White House and read it and thus learned about Watergate. Art Buchwald was a political humor columnist for the Washington Post. I am imagining some twelve-year-old girl in 2039 reading a Petri collection, getting about 30% of the jokes and enjoying it a lot.)

(Also I should look up whether there is critical scholarship discussing Alexandra Petri, Alexandra Erin, the Toast work of Mallory Ortberg, and whoever else is doing .... this kind of thing in this era. *handwave*)

Work, theater, sun, books, fanvids

Jun. 19th, 2017 11:24 pm
selki: (thoughtful)
[personal profile] selki

I've been more Linux-technical at work lately, with software installs and being on call this last week (100+ pages to deal with). Possibly a good thing in self-defence, as I think those with tech skills are less vulnerable to cuts in forces (always a risk when contract renewal is coming up, to show they're getting leaner).

We saw a really good Rude Mechanicals production called She Speaks: more Shakespeare! This production weaves together a number of woman-centered scenes from different plays. The staging and weaving of some of the scenes, mixing together characters from different plays speaking on similar topics, and sometimes the same actor (now one, now another character from different plays) was moving.

Went to a pool party, got a little burned.

I've finally worked through all the Wiscon stuff I was going to read/watch. I've only made it to one Wiscon, but I usually find something of interest in the panel write-ups, and I love the fanvids!

  • Miscellaneous links roundup
  • Fanvids! My favorite from this year's viewing party: Landsailor about engineering, flight, and working together. But Wake Me Up (not the before you go-go song) made me laugh at least partly from having read a Tweet from one of the online magazines recently telling folks that it is VERY hard to get published a story that starts with the protagonist waking up, because they get so very many submissions that start that way.
  • Catherine Lundoff's Old(er) women in SF/F resource list (see also part 2), with a few comments from yours truly on each page.

Phil Rickman's Merrily Watkins mysteries/thrillers didn't quite fit for a recommendation there (protagonist in her 30s, to begin with, anyway): In the first book(The Wine of Angels) she moves into a small town to be the local vicar (and quietly and with some struggles in faith, an exorcist) with her teenage daughter, but she surely gets there over the series. Her teenage daughter takes a different path in dealing with what she sees. Thoughtful, long books.

Heat regulation

Jun. 18th, 2017 07:36 pm
badgerbag: (Default)
[personal profile] badgerbag
First super super hot day here. If tomorrow will be like this I need to find the fan in the garage.

I just shaved about a pound of side hair off (it is thick) and have put it in the worm bin. Good compost aeration! And, felt happy I had cleaned and organized the closet weeks ago as I easily found my little box of house dresses.

I'm wearing this amazing reversible soft linen sleeveless dress, with a pocket for my handkerchief, that I got from Flax on skud's recommendation a few years ago (converting me fervently to linen) And my hair has been up in a top of the head ponytail all day (now much more effective with the side hair shaved off.) I think of skud affectionately whenever I wear this amazing dress (maroon on one side and lavender on the other). The pocket handkerchief is daintily printed with violets. I ironed it the other day, as I enjoy doing.

Now you know everything. All my secrets. Dresses, ironing, and the fact that I have that chicken yodeling song stuck in my head.

Experimental notebook transfer

Jun. 18th, 2017 01:40 pm
badgerbag: (Default)
[personal profile] badgerbag
So out of the habit of blogging. The back injection was harder to take this time than usual (I think) Thursday is very fuzzy - I barely remember it after I got home. Dossie brought me to the pain clinic and I do remember them giving me an extra dose of whatever it was into the vein, as I was cussing and had trouble staying still for the needle. The clinic is trying a new thing where they play you music on request during a procedure so I asked for Bach. How do you spell it? Nurse very puzzled. Then the one thing I remember other than Dr. Pham telling the resident, You have no idea what is about to happen here and me laughing and then cussing my head off. In the middle of it as I got calm, exclaiming, "Oh, Brandenburg Concerto number 3" and feeling clever to have any brain cells at all.

I can't actually remember getting in the car or getting home at all but I believe Dossie must have got here and then Milo was here as well so.... ?

Not sure if it is worth it. Some times I feel better immediately but this time I have been in an annoying (semi incapacitating) level of pain at the injection sites from Thursday to Saturday. I had to skip a nice board game birthday party and a punk rock history movie. Very quiet weekend alone. Rosa came over for tea and to pick up some things - I haven't seen her in a while. I am somewhat functional but in small bits and without bending over much. The quiet weekend has meant I am more than caught up on tidying up after myself and other people. When that happens I can make inroads on the accumulated disorder. We need to get rid of some books. Also, I think the anesthetic and sedative and steroids together made me feel strange, brainless, aimless, exhausted.

Today has been better. I went up the hill to Pinhole cafe and went through some bits of 3 different notebooks. I tried to copy any worthwhile bits out of the big black moleskine one from December into the 2 new ones, especially working on the Andromeda and Venus poems. I am fairly happy with the first bit, have lots of the 2nd, some of the 3rd but it is not quite coalesced and something to #4. Nothing on 5 (Maybe?) But the structure is more clear to me. I wrote some new snippets and copied over other parts. Found the notes I took in my lap at the actual dance performance that it's about.

Horrors when I was on my way to Dossie's office Tues. evening and realized there was NO NOTEBOOKS WTF. I got a substandard one in the walgreens (nothing else open) So here is my entry from it before I tear out the pages and pass the unsuitable notebook on. (I am too fussy, but I don't like a yucky feeling cover, or a size too small with binding too tight, as I can't think on paper well without wider space)

>>> Lovely jcab driver named Yosief from Eritrea a poet who used to write for the newspapers. We talked about the route and the pleasure of driving around to random places following where someone else wants to go (better than seeing nothing in a 7-11 as he was at first and no one would talk with him) It is other people's choices. We admired Glen Park Canyon as we drove up the street alongside.

His family's place in Eritrea is very beautiful with trees with fruit of all kinds, grapes, plums, and their neighbor had cows so they would trade for milk. The family thought of expanding the house but it would have meant cutting down some of the fruit trees so they had a big family meeting and decided not to. He feels like trees with fruit almost have a soul. You have to respect them. I added you feel connected to the land when you eat something you know comes right from it that you grew and picked.

He described how Trump is just like the dictator in Eritrea , how they fought for independence but then got a dictator for 26 years no better than before. America is supposed to be for disagreeing and discussing anything you want without hate. He has a picture he cut out from the paper of Nancy Pelosi and John Boehner kissing each other on the cheek and shaking hands which he framed and put on the wall as it is the spirit of America that they completely disagree but can at least act friendly. But now maybe things are going bad and we can't think that we are immune from society falling apart. It can happen here, and the rich and greedy are the same everywhere, they only want power and they don't care what happens otherwise. He has to call up his family and tell them everything about politics, and they try to protect him by telling him it will be OK... because they know he's sensitive.

In case you can't tell this was all completely charming and I told him how I am also a poet and translator and about Carmen's book and said we should email and send poems. I went to write down my email and realized NO NOTEBOOK and not a scrap of paper on me. This never happens! How embarrassing just when I claimed to be a writer! He put his email into my phone but then i accidentally thought i lost it when I closed the email app. But! Found it! Now, he wonders if I will help him translate a poem? I may do this (counting on no misunderstanding about a meetup)

>>>
My plan was to hang out in pt. reyes town and write and work on poems while D. was at her appointment but no notebook. I can likely buy a decent one there in the bookstore.

Middle section of poem cycle as visual play across page with form? In a cleft or split going vertically for the structural supports. Too much? Or better have it underpin every page or some pages running through the whole thing as the supports should be 100% visible. Rodin's anatomical studies for those guys in the village (aldermen?). So, either that or 3rd section would be ramp/cleft/structure and 4th would be naiads.

Thinking of the free play across the page that I admire. The comical woman crossing the atlantic communist poem, Elvira H. Carta de viaje - more free and far-ranging. That space & far-ranging wide freedom has to underpin the entire Descent cycle. Consider also American Air (together with carta de viaje, atlantic, ibarbourou atlantic poems, in its own little book?)

Note, add Florentino book to ebook list for Burn This Press. Nearly forgot it.

>>>
Punchline of this is that a day later I found one of the 3 notebooks at the very bottom of my big backpack. So was able to work after all, with notes.
terriko: (Default)
[personal profile] terriko
This is crossposted from Curiousity.ca, my personal maker blog. If you want to link to this post, please use the original link since the formatting there is usually better.

Back in February, I keynoted at Pycon Pune in India. I decided to start with one of the questions that comes up frequently when I tell people that my day job is in open source security: “Is open source software really more secure?” Here’s the video!



Hopefully one of these days I’ll get the slides and a written transcript up, but for today, please just enjoy the video. Note that there’s some silence at the start of the video while we’re setting up. I start talking at the 1m50s mark, and the embedded video should start there.


Pycon Pune Group Photo


Open source security is something I’m very passionate about, and I was really glad that the fine folk at PyCon Pune gave me the chance to tell their attendees more about what it means to be secure and what it will take to make open source security even better. I believe there were over 500 people in the room for my talk, even though I was the the final keynote for the conference, and it was one of the greatest audiences I’ve ever had the privilege to talk to — very responsive, lots of great questions, and lots of great follow-ups after the talk was done. If you ever get a chance to speak at Pycon Pune, I highly recommend it. Keep an eye out for next year’s call for speakers!


This also ticked off a few bucket list items for me:



  1. Visting India! I work with a number of people from India and meet new students from there nearly ever year, so I’ve always been curious, but it’s a long an expensive trip. Thankfully it turns out it was also on J’s bucket list so we found a way to make it happen. It’s a super beautiful country and very different from my own. We were fortunate enough to spend some time being tourists before the conference, as well as lots of time socializing with the conference attendees and volunteers.

  2. Keynoting a conference! I’ve wanted to do this for years but opportunities don’t come up very often and I wasn’t able to accept the last offer I got.


PS – Interested in inviting me to keynote? I’d love to do another one! Send an email to terri (at) toybox.ca to let me know. I have a list of my speaking experience on my website. I talk a lot about security, but I’m happy to talk about open source mentorship, community, artificial intelligence, and quite a few other things, just ask!

music in Steven Universe

Jun. 16th, 2017 02:54 pm
brainwane: My smiling face in front of a brick wall, May 2015. (Default)
[personal profile] brainwane
Post-WisCon, I have a new hairdo (a pretty butch sort of fauxhawk) and my spouse and I have started watching Steven Universe. We're around the beginning of Season 3 I think which means we just saw the episode that had the duet-with-piano "Do It For Her". Is it just me or is that the song (so far) that sounds most like it could fit into a Broadway show? Like, change the words a little and it could go into Wicked?

(Also the theme tune just switched to a new arrangement and I am still getting used to this.)

Bujo Gear in Unexpected Places

Jun. 16th, 2017 05:27 pm
peartreealley: (Default)
[personal profile] peartreealley posting in [community profile] bujo
I went for a little ramble today and on a whim popped into the gift shop for the Tower of London and found... these:



It's certainly not where I expected to find tea cup sticky tabs and washi tape (although they don't call it that, of course), but I snapped them right up!

Have you found Bujo supplies in unexpected places?
nanila: (not good with computer)
[personal profile] nanila
At the meeting I attended recently, I noticed that one of my colleagues and his elegant wife were wearing their glasses on chains. They're a decade or so older than I am, but it occurred to me that now I'm in my forties, I may have achieved the age of "glasses chain wearing" majority.

Poll #18498 Glasses chains
Open to: Registered Users, detailed results viewable to: All, participants: 50


Am I old enough to start wearing my glasses on a chain?

View Answers

Settle down, whippersnapper. You've got to put in another decade yet.
18 (36.0%)

You have grey hair and you forget where they are when they're on top of your head, so yes.
32 (64.0%)

Monthly and Weekly Spreads

Jun. 15th, 2017 09:42 pm
peartreealley: (journal)
[personal profile] peartreealley posting in [community profile] bujo
I've been Bujo-ing in various incarnations for a couple of years now, and while I'm great at the journaling and collections aspects of Bujo, the use of it as a planner I constantly fall down on. I make a spread for the week or the month and then completely forget about it. Oops.

I know there are a eleventy-billion examples of logs and spreads on the 'net, but I'm wondering which sorts of monthly/weekly spreads/logs have been most successful for the community in keeping you organized? Which ones haven't worked? Why? How much info do you put on it? Elaborate? Minimalist? How often do you refer to it? How do you keep it from getting lost and forgotten 30 pages later?

(I feel like this is a ridiculous question, but clearly I haven't found a good answer on my own.)
nanila: little and wicked (mizuno: lil naughty)
[personal profile] nanila
Cars & Daddy on a bicycle
In this drawing by Humuhumu, done in purple pen, you see two cars on the left and Humuhumu's Daddy on a bicycle on the right. These are the things Daddy likes to do: driving, riding bicycles, and driving us to places where we can all ride our bicycles.

Dashi from Octonauts
In this drawing by Humuhumu in the lower left and upper right, you see renditions of Dashi, the dachsund from the BBC children's show Octonauts, in light blue marker pen. The octopod is partially visible in the upper left, as is "Dashi nose practise" in the lower right.

Dashi is Humuhumu's favourite Octonaut. Here is the description of Dashi from the Octonauts web site, emphasis mine. Dashi is a smart dachshund / sausage dog who oversees operations in the Octopod HQ and launch bay. She monitors the computer systems and manages all ship traffic. She's also the Octonauts' official photographer and enjoys taking photos of undersea life.

....Oh. Ah. Huh.

Moving party this weekend!

Jun. 15th, 2017 12:38 am
azurelunatic: A glittery black pin badge with a blue holographic star in the middle. (Default)
[personal profile] azurelunatic
In a much more leisurely manner, belovedest and the boxes and the cat get to re-trace their pilgrimage.

It's been a super interesting day, yup.

A Woman of Wonders

Jun. 14th, 2017 02:44 pm
azurelunatic: Scissors cutting film. NaNoWriMo 2004 (Home Movies from the Cutting-Room Floor)
[personal profile] azurelunatic
For my birthday, I had a lovely Afternoon Out with my metamour -- sushi, pedicures, pastries and coffee, wandering around the mall.

We were then joined by my primary partner, and we had a three-party date to see Wonder Woman, which was fantastic. So much fun, lots of awesome women, and Chris Pine makes a great sidekick.

I am coming to Wonder Woman very late. (There's a very sad story somewhere in there, of what I think was a movie book for some female superhero, which was on the book racks in my 4th grade classroom. It looked interesting, so I picked it up to read. It would have been at most a 45 minute time investment. Unfortunately, the movie itself was apparently deeply uncool, and reading the large-format with-pictures book of the movie was even more dorky. Which some young dickheads in my class promptly noticed, and mocked me for. Which ended my brief interest in the idea of comics at all.)

Lynda Carter, the original Wonder Woman, came to talk at Virtual Hammer one day. It was an amazing experience, and an honor to be in the same room. Of particular note was the engineer standing up, clutching her Wonder Woman lunchbox, and tearfully thanking her for being a successful woman who looked like her; Wonder Woman had given her the strength as a little girl to follow her passions. (Upon seeing that, a nearby male engineer who had drawn one of the golden tickets surrendered it: it would have been an interchangeable experience for him, but a lifelong dream realized for her.)

I kind of took the movie in as huge globs of thick awesome: the island! the women! the training! OMG THE OUTSIDER! and went from there.

My partner was sitting in the middle, and as such was getting fed treats from either side, and getting whispers from either side. At a certain point, after there had been screen time for a particular character, I had a thought, and whispered it. "I fear it would be too subtle for [a large loud comic book franchise movie] if [SPOILER] were really [SPOILER]." My partner threw their head back and laughed, and agreed: probably too subtle.

WELP.


It's also amazing to have a superhero storyline with such a nice balance of fire and kindness. Wonder Woman is going to straight-up stab people. But she's going to see what else works, first. That's her whole concept. It's lovely.

The Girls Interrupting podcast had a little episode on the movie, and they talked about a thing from one of their favorite comics. Read more... )

In my own life, I aspire to be more like Wonder Woman, to extend a hand before straight-up stabbing -- but not waste time when it's actually clear that extending your hand is going to get it sliced off. And I think I've been falling behind on self-examination. I need to make more moments where it's just me. No matter how honest I am with my trusted friends, there's always the temptation to try to make myself look better than I know in my heart that I actually am. I can help solve that by narrowing the audience. I can widen it later if I like. It's scary to write down some of the things, but if I write them down, that means there's more room in my head for the important things. Kindness. Truth. The willingness to straight-up stab Nazis.

Profile

radhardened

February 2017

S M T W T F S
    1234
567891011
12131415161718
19202122232425
262728    

Most Popular Tags

Style Credit

Expand Cut Tags

No cut tags
Page generated Jun. 28th, 2017 07:21 am
Powered by Dreamwidth Studios