3 ms·
This is doubling down with more poorly considered assumptions and demonstrating an overwhelming lack of knowledge about security process, and with such vehement
by inopinatus 5y ago
This is doubling down with more poorly considered assumptions and demonstrating an overwhelming lack of knowledge about security process, and with such vehement and pernicious language I could only laugh aloud at the remarks.
Because: we already do routine malware scanning and audit, and review of every changing dependency that we know of, and their transitive dependencies. The scale and frequency of change is one of the reasons to minimise exposure to the fragmented, chaotic shitshow of the node ecosystem.
When there's an incident - and this is most definitely an incident - we have to do more work to verify there was no inadvertent occurrence, that it did not slip through, etc etc.
What's more, one must necessarily download the shit to inspect it, which means you're potentially now holding an unexploded bomb sitting in your developer laptop, for which possibly the only mitigation is that it's sitting inside a container or virtual machine, and one must be careful not to trigger it.
Due to the destruction of trust, we'll also be making an additional effort to remove and replace this and any other package from the same author, and any repository to which they have contributed has to be considered potentially tainted and subject to additional review.
Since you didn't apparently know any of this, I don't think you have any standing to comment on security team procedures.
- rosndo 5y agoNah, your processes are just terrible. They might be “industry standard”, but so was storing plaintext credit card information. >This is doubling down with more poorly considered assumptions and demonstrating an overwhelming lack of knowledge about security process Sorry, but no. I’ve worked in this field for two decades. What you’re describing is meaningless security theatre meant to appease the people paying your salaries.
- inopinatus 5y agoOh look, some more poorly informed personal invective! I had no idea it was possible to triple down on being a clueless dick, but you’ve successfully demonstrated that point. Alas, nothing else. Oh, and only two decades? It explains the rookie naïveté and flailing, ranting insecurities, I suppose. But I think you’ve got a fourth go in you, why stop now? I’m sure there’s a few more witless assumptions and unoriginal epithets left to fling around in vacuous defense of the indefensible.
- rosndo 5y agoNo matter how many words we waste, you will still be the guy complaining about your job being a waste of time while simultaneously trying to defend the decisions causing you to waste your time. And for what it’s worth, you started it with the insults and silly appeals to authority.
- inopinatus 5y agoThere we go! Moronic, childish, deluded nonsense, and you still haven’t added anything of substance since “you are the idiot”. I’ve also just realised you’re the same nutter who was desperate to prove Bill Woodcock doesn’t have (and I quote) ”basic understanding of DNS”. Ok, I’m done smacking this particular witless, flailing troll around. Be seeing you.
- rosndo 5y agoSee, that’s all you’ve got. Empty appeals to authority. Bill Woodcock got the technical details utterly wrong. His track record doesn’t matter when he’s spewing out bullshit, it’s still just that. Just read your comments again https://news.ycombinator.com/item?id=30513375 https://news.ycombinator.com/item?id=30513375 You were trying to argue that pulling out root nameservers from Russia would be a bad thing because … Roskomnadzor can only restrict access to foreign DNS servers? And you call me deluded.
- inopinatus 5y agoNot sure what you mean by "appeals to authority". Fairly sure you don't know what that phrase means. Whose authority, exactly? I'll appeal to my own, I suppose, but that is because I actually know what I'm talking about. Definitely sure you don't have anything to say, but are committed to telling people they're stupid because ... you have little else to contribute, and are stuck in a muddy trench of incoherent rage you dug for yourself. Again.
- rosndo 5y ago