Just some ramblings. Probably about CSP.
Play it here ( code on GitHub ). No install, no account. BYOK if you want to leverage AI for more than a few choices (ML content is free). Desktop or iPad strongly recommended; mobile is playable but cramped. I’ve spent most of my career in security and backend-adjacent work so my frontend skills had gone stale. CSS still humbles me. So I picked the most over-engineered way imaginable to brush up:…
It’s official, the job search is over and I’ll be starting as a staff software engineer for ActBlue later this month. Why did I choose ActBlue? They are non-profit and while they pay competitive salaries, there is no equity. They have bonuses to help make up the gap, but there will be no big payday at the end of this road. At this point in my life, the idea of possibly hitting the lottery again…
The “perfect” guest appearance (for me) I guess I can continue with “the perfect X (for me)” pattern here. I like it because it illustrates strong opinions but acknowledges that everyone is different, and I very well may be in the minority with some of these. I don’t intend to be an edgelord contrarian person but instead, take time to critique my own ideas from different viewpoints. Funemployment…
It’s been nearly a decade since I’ve done a true job hunt where I’m chasing down multiple opportunities. I have interviewed and hired people since then so it’s not like I’m completely detached from everything but some conversations have been surprisingly aggressive. I’m attempting to perform a career switch after spending a year in management, I get it. That’s a different profile than someone who…
The most important factor in choosing my next company is the culture. I expect it to be inclusive and striving for diversity and belonging. I expect it to have reasonable work expectations. In America, that means 40 hours a week. I think that number should be lower but hey, it’s what we have. Async I’m baffled that we’re in season 3 of the pandemic and many orgs are still figuring this out. I have…
The “perfect” interview (for me) I want to start with a healthy dose of “the world does not revolve around me” before these hot takes. I’ve felt myself struggling to best demonstrate my capabilities during this round of interviews. I don’t expect myself to perform flawlessly in every situation, but there seems to be more resistance to my transition to engineering than expected. This hesitation is…
I recently started a job search after leaving GitHub in November of 2021. I’ve tweeted about it, a lot. I was somewhat inspired by Taylor Poindexter’s search where should would post updates to Twitter about the search. She posted very opinionated statements that I’m sure attracted some unwelcome attention. I agreed with practically everything she was saying. The way she set boundaries and…
Note: this has been fixed . XSS to RCE “yeah right, RSnake” I accidentally triggered a cross-site scripting (XSS) vulnerability in <conf provider X> that worked when using the web application as well as the native OS X application (and possibly additional clients). Nowadays, XSS -> Remote Code Execution (RCE) is possible thanks to Node. For every person in any meeting that I join, I could execute…
We recently scrapped our previous CSP reporting endpoint and built a custom, single-purposed app. This is highly proprietary and will never be open sourced (do you run scribe, viz, logstash, etc???), but here are the building blocks of the design. This just launched a month or so ago, so I’m sure there is room to improve. Normalization The incoming data is very wacky. Various browsers with various…
In order to help ease approval for the Content Security Policy script-hash proposal , I created a PoC to demonstrate that this is just as easy as script-nonce. I believe script-hash is an idea that solves some of the shortcomings of script nonce. However, it is significantly more complex. I think that the complexity can be greatly reduced with proper tooling. My PoC branch aims to prove that this…