This was also my observation after growing up in New England and then moving to Denver, Colorado. People were much more open to conversation than I was previously used to which felt like a breath of fresh air. I realized people in New England seemingly default to a “defensive” interaction mode when conversed with without a pre-shared common ground, such as a task or moment. Its quite apparent when visiting family back east.

Fellow New England -> Colorado transplant. It was pleasantly shocking for me too how much chattier and friendlier people are in Colorado. But now I've lived in Colorado long enough that when I go back to visit New England, it's shocking how cold and taciturn people are there. Conversations with strangers rarely get past "How ya doin?" "Fine and you? "Fine, thanks."

I do appreciate how direct people in the northeast tend to be, and sometimes miss that aspect of the culture.

I grew up in small town Midwest and have now lived in tiny town New England for 20+ years. It still bothers me that folks here in New England won’t even acknowledge you on the sidewalk as you pass each other whereas in the Midwest that is a good excuse for a conversation. They haven’t worn me down though, I still say hello at least to each person as I pass and maybe get a mumble back 50% of the time.

Great read, fun times ahead of us.

This brings me back, I had this happen to me on comcast back in ~2014 - reset the master key on the account and attacker gained access into all my parents emails as well since they were also via comcast. I’ll never forget waking up to that one! Always wondered what SE happened behind the scenes to make it happen - thanks for sharing.

I deal with the exact same mental model. I think for me, while actively gaming I do have fun. It’s only after the fact I look back on the time wasted gaming and think “wow, I really should have worked on that project I want to build instead of playing a game”. It’s also hard to rationalize time spent gaming when you have nothing to show for it afterwards.

If you ever figure out the solution to this negative thought-loop, let me know please!

My mom does the same thing regarding “sales”, even after explaining to her the marketing/reasoning aspects of them. If she sees something on sale that was “originally $900” but on sale for $80, shes excited to buy it. It quite literally doesn't matter what it is. It’s nice to see I’m not alone in this situation with her. I can’t wrap my head around it!

Here's an idea. Print out a list of charities that you think she might give to, like a big glossy page with 5 choices, and throw in a few "Limited time double your contribution" type marketing slogans. Tell her next time she is going to buy something because it is on sale, she could consider the joy of giving to those in need.

This might be the first time I felt disappointed and sad reading an article like this. The commented username and password felt like something from an early 2000s tv show with the tech guy doing “hacking”.

Wonder how many others stumbled upon this prior, and makes me also wonder how many other sites have things like this hidden in plain sight. Insane.

This may look "boring" or "uninspired" but this is what real cybersecurity and "hacking" looks like.

In most cases, security and QA are essentially two sides of the same coin - and this is why I get pissed when devs treat testing and QA as bulls**t, becuase even a relatively simple XSS attack or cred misconfig can have a massive impact.

This has nothing to do with testing. This is a lack of training.

I would say they need to 'think like an attacker' at least some of the time. But this is still too high of a bar.

I think this is really a problem of rewarding people when they finish things. One way or the other. It works, so on to the next project...

As someone who has been a SWE, PM, and VC in the cybersecurity space and constantly meets with CISOs as well as has formerly been a security practitioner (I should get back to using HackerOne again for fun), I can safely say that the overwhelming majority of security incidents are due to some form of misconfig because development and code review are orthogonal to proactive security checks.

Shift-left was supposed to fix that but it failed because the primary persona to sell ended up becoming the CISO again, and not trying to find a way to make security ownership a Dev and QA responsibility as well (this is largely organizational).

> This has nothing to do with testing.

A good QA can catch/test such security issues although most of such work is given to a dedicated pen tester to find weakness in the platform.

I’m confused. Isn't this more or less just listening to someone when they speak? I guess seeing it from their perspective isn’t a default for some people?

I usually work in analogies when trying to share my understanding of what they said, whether it is a story or a question.

I may be misunderstanding this a bit, but the inverse or active listening seems to be someone who is distracted and not actually listening to another person? For example: “Wow, yeah, thats crazy” when someone is rambling.

You've never experienced someone who isn't a good listener? It's fairly common and not always intentional.

For example, Kids are great at rambling off information for attention. Active listening is a skill and isn't the default.

Even if someone is listening, active listening is hearing what the partner says and attempting to intuit why they would think that and what assumptions they are making that may be different from your own.

I have the same opinion. This is just a normal conversation. If I'm not doing this, I either want to rant to someone or I'm in a so hostile conversation that it doesn't make sense to do it.

There is capital “A” Active Listening, which is in a family of behavior modification techniques in which the interviewer can follow the aforementioned scripts to increase engagement…

And lowercase active listening, IMHO is genuinely being interested in the experiences of the person talking that your line of questioning disarms the subject into sharing stories that add personal, “cultural” context to their choices which could be considered taboo.

I’m scared that people think actually listening and not just waiting to speak is a novel or new idea.

It is, and it's not equally intuitive for everyone.

You should also mention it was made with a templating engine you created! Makes it a lot cooler as a demo!

Yes, I did it, but modestly.

Instantly spammed with fake android security breach popup ads on mobile, absolutely will not be trying this. This is probably why .xyz TLD is blacklisted from so many places.

Wow, thats pretty bad. Reminds me of the old Paypal Invoice scams where scammers would upload the paypal logo as the invoice logo (which appears top left) and essentially “bill” the user. The scammer the adds inside the invoice note a paragraph explaining “Your money is being held due to currency exchange issues”, which gives basic reason to the “monetary deduction”. It got me as a kid, was quite slick for the time. Thought these scam-methods would be at least flagged these days before going out.