4 ms·

I don't think Palantir should be shamed for this. It's laudable that they invested in penetration testing - better they find out this way than by an actual APT/

by hendzen 10y ago

I don't think Palantir should be shamed for this. It's laudable that they invested in penetration testing - better they find out this way than by an actual APT/hacking group.

quanticle 10y ago
Exactly. And has been pointed out elsewhere, pretty much every large tech firm does red-team/blue-team tests these days. It's just that we don't hear about the vulnerabilities that are found at those other firms.
jwcrux 10y ago
Exactly. It's crappy that they are likely getting flack over this. Chances are, it was leaked by a disgruntled employee. But the fact is that the red team started on the internal network and used tactics that would work on darn near every org these days. Palantir is no different. The only issue is that their pentest report was leaked.
- jzwinck 10y ago
  Given the nature of Palantir's business, isn't it sort of a big deal in itself that an internal report was leaked? What if the leak had been some other internal document, say one that contained customer secrets?
  - tptacek 10y ago
    The leak, if that's what this is, is a big deal. The contents of the report are not.
hackuser 10y ago
> It's laudable that they invested in penetration testing I don't think they should be lauded for doing their jobs and discovering they failed at them. If your QA team discovers huge numbers of bugs, you don't laud yourself for doing QA. If a leading accounting firm hires an outside auditor and discovered their own books were rotten, should they be lauded? I guess there's a silver lining in everything. I guess I'd be willing to trust Palantir's advice on hiring penetration testers, but not on securing my systems.
- dsacco 10y ago
  To play devil's advocate: there is a reasonable expectation that an organization's accounting is legally and correctly balanced. It is not a reasonable expectation that software, even security software or software developed with security expertise, is secure.
  - homunculus 10y ago
    I would say you can reasonably expect that unaudited software is not secure and that unaudited books are not legally and correctly balanced.
- jsprogrammer 10y ago
  Why would you trust them in hiring pen testers? Their systems might have been so bad that any one attempting could have gotten in and thus firm was just lucky enough to get the contract.
laxatives 10y ago
I would love to jump on any anti-Palantir band wagons, but I agree -- if anything, they should be rewarded for actively seeking and patching vulnerabilities. It seems economically infeasible to be invulnerable to all attacks from all vectors and this is a way to strip the lowest hanging fruit.
deleted 10y ago
[deleted]

by hendzen 10y ago

I don't think Palantir should be shamed for this. It's laudable that they invested in penetration testing - better they find out this way than by an actual APT/hacking group.

quanticle 10y ago

Exactly. And has been pointed out elsewhere, pretty much every large tech firm does red-team/blue-team tests these days. It's just that we don't hear about the vulnerabilities that are found at those other firms.

jwcrux 10y ago

Exactly. It's crappy that they are likely getting flack over this. Chances are, it was leaked by a disgruntled employee. But the fact is that the red team started on the internal network and used tactics that would work on darn near every org these days. Palantir is no different. The only issue is that their pentest report was leaked.

jzwinck 10y ago
Given the nature of Palantir's business, isn't it sort of a big deal in itself that an internal report was leaked? What if the leak had been some other internal document, say one that contained customer secrets?
- tptacek 10y ago
  The leak, if that's what this is, is a big deal. The contents of the report are not.

hackuser 10y ago

> It's laudable that they invested in penetration testing I don't think they should be lauded for doing their jobs and discovering they failed at them. If your QA team discovers huge numbers of bugs, you don't laud yourself for doing QA. If a leading accounting firm hires an outside auditor and discovered their own books were rotten, should they be lauded? I guess there's a silver lining in everything. I guess I'd be willing to trust Palantir's advice on hiring penetration testers, but not on securing my systems.

dsacco 10y ago
To play devil's advocate: there is a reasonable expectation that an organization's accounting is legally and correctly balanced. It is not a reasonable expectation that software, even security software or software developed with security expertise, is secure.
- homunculus 10y ago
  I would say you can reasonably expect that unaudited software is not secure and that unaudited books are not legally and correctly balanced.
jsprogrammer 10y ago
Why would you trust them in hiring pen testers? Their systems might have been so bad that any one attempting could have gotten in and thus firm was just lucky enough to get the contract.

laxatives 10y ago

I would love to jump on any anti-Palantir band wagons, but I agree -- if anything, they should be rewarded for actively seeking and patching vulnerabilities. It seems economically infeasible to be invulnerable to all attacks from all vectors and this is a way to strip the lowest hanging fruit.

deleted 10y ago

[deleted]