3 ms·

This is actually a best practice and I believe Amazon also advises this. So it's not really something secret. For me as a customer it is good to know they follo

This is actually a best practice and I believe Amazon also advises this. So it's not really something secret. For me as a customer it is good to know they follow these practices and communicate their understanding of it outwards. For private projects I have been experimenten with how far I can go in open sourcing everything (including server configuration) and where you hit limits. Example project: https://gitlab.com/failmap/server https://gitlab.com/failmap/server Diving into a project with a open source mindset really makes me think more about security topics from a different angle and find better solutions. Like reducing the secrets that must be known (and thus can leak), like user/database passwords. Instead of security by obscurity there is nothing to obscure.

1ba9115454 9y ago
The first step of an attack is reconnaissance. How is making that step very easy for an attacker best practice?
- dijit 9y ago
  If the only thing keeping your attacker out is that they can't do recon then you're kinda boned. Security through obscurity and all that.
- aequitas 9y ago
  Part of that reconnaissance is running vulnerability testing suites. I think that they will give a quicker answer to most of the questions than having to read through the configuration code and piecing it together. Often I myself even prefer running nmap instead of looking at the code to check some configuration.
- jasonlotito 9y ago
  How does releasing this information change that in any way to benefit the attacker?
- detaro 9y ago
  So in a scenario where you can breach their AWS accounts, it would be a noticeable difficulty for you to discover that they use this pattern to work? I'm not very familiar with AWS, but that seems odd.
- 0xfeba 9y ago
  So you save the attacker a day by explicitly telling them what software stack you use. They still have to exploit that stack. It doesn't really change anything, just possibly saves the attacker some time if they can exploit the remaining layers.

1ba9115454 9y ago

The first step of an attack is reconnaissance. How is making that step very easy for an attacker best practice?

dijit 9y ago
If the only thing keeping your attacker out is that they can't do recon then you're kinda boned. Security through obscurity and all that.
aequitas 9y ago
Part of that reconnaissance is running vulnerability testing suites. I think that they will give a quicker answer to most of the questions than having to read through the configuration code and piecing it together. Often I myself even prefer running nmap instead of looking at the code to check some configuration.
jasonlotito 9y ago
How does releasing this information change that in any way to benefit the attacker?
detaro 9y ago
So in a scenario where you can breach their AWS accounts, it would be a noticeable difficulty for you to discover that they use this pattern to work? I'm not very familiar with AWS, but that seems odd.
0xfeba 9y ago
So you save the attacker a day by explicitly telling them what software stack you use. They still have to exploit that stack. It doesn't really change anything, just possibly saves the attacker some time if they can exploit the remaining layers.