4 ms·
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?
by rlt 5y ago
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon”
Shouldn’t this be happening, like, yesterday?
- cscurmudgeon 5y agoIts the weekend! Security can wait. /s
- nix23 5y agoFor some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)
- olliej 5y agoI recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?
- lkschubert8 5y agoI've heard of similar things being done for ADA compliance. Something about requiring a phone line to be up at all the same times as the website so instead of a 24/7 call center you just turn the site off.
- detaro 5y agoIn some cases I know (with smaller orgs) it happens because someone put a requirement in that they need to react to incidents with the service within X hours, but didn't provide the budget for the employees or external service needed to have that 24/7.
- TeeMassive 5y agoDo not worry, because: > We have established a JCDC senior leadership group to coordinate collective action and ensure shared visibility into both the prevalence of this vulnerability and threat activity Very clearly they know what they will be doing.
- shepherdjerred 5y agoSecurity vulnerabilities aren’t exploited on weekends out of courtesy
- rapnie 5y agoI always deeply appreciated this strict code of honour in the 'industry'. But one should take care of what constitutes the workweek here: https://en.wikipedia.org/wiki/Workweek_and_weekend https://en.wikipedia.org/wiki/Workweek_and_weekend
- cozzyd 5y agoUnfortunately NSO group likely has a different definition of weekend.
- ygjb 5y agoNo. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode. This type of a call would likely be focused on assessing current state at that point.
- asjfj9 5y agoCould you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this? I work for a large non-US based tech company and have not heard anything about this beyond HN.
- bsagdiyev 5y agoIt’s definitely happening. People are just too busy to post about it. I’m on a few hours sleep over the last couple days myself.
- MomoXenosaga 5y agoIt was on the news in my country. There have been several notable ransomware attacks in the last few years, it's become an issue for a country and government that's gone all in on digital.
- octodog 5y agoI work for a bank in APAC region and we had at least one big change out on Friday evening to address this.
- xiphias2 5y agoI had an ex colleague at Google talking about it on Facebook...if he had to bring an internal stuff of Facebook, it must be really bad.
- xwolfi 5y agoWork in one of the largest financial org in the world as a Java dev for critical system (albeit not internet facing), learned of this just now on this thread... Edit: upon checking, we're safe, it doesn't impact log4j1, only the second version. We're not cowboys using versions as young as 2012 lol.