3 ms·
> if you are certain the software you use is secure This is the problem right here. You can be certain that the software you use has security issues.
by dotancohen 2y ago
> if you are certain the software you use is secure
This is the problem right here. You can be certain that the software you use has security issues.
- danielovichdk 2y agoSure. And so what ? Should I stop using it ?
- lofaszvanitt 2y agoAnd who will fire a 10k+ exploit on your server? So you could record it and resell? In the early days, surfing shady sites with Internet Explorer, you could net a lot of interesting js that exploited the browser.
- dotancohen 2y agoMy server is an attack vector for my 10k+ users, and all their contacts. A 1% ransomware infection rate could net them $1 million USD worst case, and potentially an order of magnitude more if one of my users is browsing from a work machine in their network. Don't underestimate the security value of people hitting your servers, even if all you think you're serving is emojis.
- lofaszvanitt 2y agoI'm not underestimating. All I'm saying if someone pays 10k or more for an exploit against ssh/nginx/whatever, nobody is gonna pepper your server with it. They will sell it to a broker and pocket the money, end of story. You will be targeted if your server seems to be the lowest hanging fruit or most easily exploitable or the target is most easily reachable through your site. Otherwise noone will bother with your setup.
- elintknower 2y agoYeah, this is also a huge concern of mine. There's also nearly no standardization / information as to how to harden just a bit more than is commonly suggested by web devs / bad tutorial sites.
- dotancohen 2y agoSeriously. When you find something, please let me know too!
- lofaszvanitt 2y agoReading the manual.
- tiberious726 2y agoThis is very much so sticking your head in the sand. Some attacks are sold to highest bidder, others are deployed wide and fast. Some of us are responsible for securing high-sensitivity systems where such a shoot from the hip and trust everything will be okay attitude isn't acceptable.
- input_sh 2y agoThe question isn't does the software I run have some sort of yet-undetected security issues, but am I a valuable enough of a target for someone to waste their yet-undetected exploits specifically targeting me? If the answer's no, then your only job is to keep up with software updates.
- lazide 2y agoIf you’re exposing your software to the external internet, you’re potentially valuable enough to get a drive by.
- input_sh 2y agoAssuming your software is fairly up to date and/or you haven't badly misconfigured it, they're not gonna do anything. There are a ton of routers and IoT devices that are a much easier catch than a machine run by someone that actually gave a thought or two about securing their server.
- lazide 2y ago[dead]