4 ms·

There is a talk from a security researcher about visiting random HTTP servers exposed to the internet. He found the control panel for a power plant, an ice ska

There is a talk from a security researcher about visiting random HTTP servers exposed to the internet. He found the control panel for a power plant, an ice skating rink, traffic lights, etc. There was even a button that you could press to put the traffic lights on test mode, that had a message saying "Warning: injury or death can occur". No authentication was required for any of those systems. Why? because some people wrongly believe that not being behind a domain name and not being on a search engine (other than shodan, of course), makes their shit secure. That's why sometimes I think working in IT or software should require a license.

achillean 5y ago
It was probably one of @Viss's talks. Here's one he did at DEFCON: https://www.youtube.com/watch?v=-T-3buBwMEQ https://www.youtube.com/watch?v=-T-3buBwMEQ
- 29athrowaway 5y ago
  Thank you, this was the talk I was referring to. I had forgotten the exact name. Entertaining yet worrying.
heurisko 5y ago
Until then, it would be helpful if projects prompted during installation to setup authentication (and didn't continue without) and were bound to localhost. I wonder why MySQL and postgresql databases don't show up on these lists.
- rhlresearcher 5y ago
  We majorly focused on NoSQL databases
DyslexicAtheist 5y ago
> That's why sometimes I think working in IT or software should require a license. IMO the problem isn't lack of training or another licensing scheme but the lack of budget companies allocate to QA & Security.
- jimktrains2 5y ago
  And a license and code of ethics would be a concrete way to push back against employers cutting coats or time.
- 29athrowaway 5y ago
  Licenses can be revoked. When you know you can lose your license, being a duct tape programmer becomes a liability. People will want to understand what they do, and be reluctant to work for tech debt mills. As a result, tech debt mills would die and be forbidden from making software. It would be a wonderful world.
deleted 5y ago
[deleted]
belter 5y ago
The presentation mentioned below in the thread is not bad.Sounds like its the one you were referring to, but for complete madness and awe I recommend to watch this one: "115 batshit stupid things you can put on the internet in as fast as I can go" by Dan Tentler https://youtu.be/hMtu7vV_HmY https://youtu.be/hMtu7vV_HmY There is a point where they find a large Dam in France with water gates control available in the Internet. They use the US Embassy to contact the French government department responsible and urgently do something about it. They are told: "Not right now, we are currently on holidays..." :-)

achillean 5y ago

It was probably one of @Viss's talks. Here's one he did at DEFCON: https://www.youtube.com/watch?v=-T-3buBwMEQ https://www.youtube.com/watch?v=-T-3buBwMEQ

29athrowaway 5y ago
Thank you, this was the talk I was referring to. I had forgotten the exact name. Entertaining yet worrying.

heurisko 5y ago

Until then, it would be helpful if projects prompted during installation to setup authentication (and didn't continue without) and were bound to localhost. I wonder why MySQL and postgresql databases don't show up on these lists.

rhlresearcher 5y ago
We majorly focused on NoSQL databases

DyslexicAtheist 5y ago

> That's why sometimes I think working in IT or software should require a license. IMO the problem isn't lack of training or another licensing scheme but the lack of budget companies allocate to QA & Security.

jimktrains2 5y ago
And a license and code of ethics would be a concrete way to push back against employers cutting coats or time.
29athrowaway 5y ago
Licenses can be revoked. When you know you can lose your license, being a duct tape programmer becomes a liability. People will want to understand what they do, and be reluctant to work for tech debt mills. As a result, tech debt mills would die and be forbidden from making software. It would be a wonderful world.

deleted 5y ago

[deleted]

belter 5y ago

The presentation mentioned below in the thread is not bad.Sounds like its the one you were referring to, but for complete madness and awe I recommend to watch this one: "115 batshit stupid things you can put on the internet in as fast as I can go" by Dan Tentler https://youtu.be/hMtu7vV_HmY https://youtu.be/hMtu7vV_HmY There is a point where they find a large Dam in France with water gates control available in the Internet. They use the US Embassy to contact the French government department responsible and urgently do something about it. They are told: "Not right now, we are currently on holidays..." :-)