3 ms·
What does this have to do with this incident? Do you think attackers having to scan 10 or more open source repo hosts for leaks is impractical? If so, maybe th
by creato 6y ago
What does this have to do with this incident? Do you think attackers having to scan 10 or more open source repo hosts for leaks is impractical?
If so, maybe that's a worse situation? After all, if it's harder for attackers to scan, it must be harder for"white hats" looking for leaks to report?
If anything, this might make companies increase the risk they associate with open sourcing their code. This wouldn't have happened if solar winds were not uploading anything at all to github...
- _jal 6y agoIt isn't open sourcing that increases risk, it is the open repositories. It is a vital distinction to make. Code needs to be scanned for secrets even in closed repositories because of insider threats. But opening them up guarantees your mistakes will be caught by, ah, volunteer sysadmins. I understand you're pointing out that fuzzing the distinction is a way for someone with an anti-open-source agenda to advance their efforts, just trying to make the point explicit.