3 ms·
If the application is not exposed to public internet - who cares ? TBH most best practices preach for security by obscurity. If you talk to any good vulnerabi
by pojzon 4y ago
If the application is not exposed to public internet - who cares ?
TBH most best practices preach for security by obscurity.
If you talk to any good vulnerabilities researcher - they will tell you what to really look out for.
- jimt1234 4y ago"We're not internet-facing, so we're not at risk, so we're not concerned with security." Standard misconception. I once worked with a team running a large Hadoop cluster. Everything in a private network. Nothing internet-facing. No risk, right? Well, a Python library they were importing got compromised and was using all their nodes to mine Monero. Oops! The cluster had been running for weeks. The only reason anyone knew about it was the performance of the cluster was terrible; all the CPUs were maxed, yet no jobs were running.
- pojzon 4y agoThis example is a borderline case. This means that not only they got hacked but also pip repo they were using. Which means that their provider also did not run any dependency scans. Tho if they fetched that from github open source repo -> yup thats just incompetence.