My partner is looking for work. I'd appreciate boosts.

He's looking to move into #appsec, but will accept short #webdev or #devops contracts (<12 months). Location: Melbourne Australia, or remote. For a short enough contract he'd go anywhere though.

He's a senior full stack web dev (Linux/python/django/js/elm, ~12 years).

Experienced in dev ops, dev sec ops and automation (ansible, selenium, etc etc).

He has experience with OWASP ZAP, bandit and Snyk, and is part way through the PortSwigger academy.

FOSS contributions include writing a django authentication function for OWASP ZAP, making a wrapper to improve accessibility and usability for selenium (Elemental), and other bits and bobs.

He isn't on any socials, but if you want to get in touch I can share his email or signal ID (or give him yours).

He and I have been the security people for little apps without any dedicated security team, for the last decade or so. If you're in security you might have met him (or me) at conferences (Disobey, BSides, CCC, Defcon and Ruxmon), because we've been attending since we launched our own app in 2014, picking up everything we can to protect our users.

(Yep, he is aware a move to security from senior dev roles will be a step down in seniority and $. He just really likes security.)

#python #fedihired #getfedihired #jobs #cyber

A friendly reminder to never trust manufacturers privacy protections.

I was recently attempting to get an external camera functioning, so I started polling various video devices sequentially to find out where it appeared and stumbled across a previously unknown (to me at least) camera device, right next to the regular camera that is not affected by the intentional privacy flap or "camera active" LED that comes built in.

I had always assumed this was just a light sensor and didn't think any further about it.

The bandwidth seems to drop dramatically when the other camera is activated by opening the privacy flap, causing more flickering.
This was visible IRL and wasn't just an artifact of recording it on my phone.
I deliberately put my finger over each camera one at a time to confirm the sources being projected.

A friend of mine suggested this may be related to Windows Hello functionality at a guess but still seems weird to not be affected by the privacy flap when its clearly capable of recording video.

dmidecode tells me this is a LENOVO Yoga 9 2-in-1 14ILL10 (P/N:83LC)

Command I used for anyone to replicate the finding. (I was on bog standard Kali, but I'm sure you'll figure out your device names if they change under other distros):
vlc v4l2:///dev/video0 -vv --v4l2-width=320 --v4l2-height=240 & vlc v4l2:///dev/video2 -vv --v4l2-width=320 --v4l2-height=240

#Cyber #Security #Infosec #Lenovo #Privacy #Hacking

What's with this #government of ours? #Canadians take note.

Bill C-8 is currently in second reading in #parliament. It's nominally about increasing "cyber" security. But it contains one of the most chilling things I've seen in #legislation.

In short, it allows a government minister to, with the stroke of a pen, make it illegal for any telecommunications provider in the country to provide any services to any specified person.

No internet.
No phone.
No anything.

Presto: you're suddenly incommunicado.

Note that's without a warrant, without a judge's approval, without a trial, without a charge, nothing, and there's nothing the person being banished can do about it until after the fact - and then they'll have to sue the government to try to overturn it. Good luck paying a lawyer for that!

This is our own little step towards fascism. Imagine a government hostile to your interests suddenly deciding you can't communicate with anyone because the things you say annoy them.

Please let your MP know that this legislation is NOT okay!

parl.ca/DocumentViewer/en/45-1…

#Canada #legislation #C8 #communications #telecommunications #cyber #security #fascist #unaccountable #minister #judge #internet