3 ms·
How can -let's say- Cursor users be sure they were not compromised? > No malicious usage was detected Curious to hear about methods used if OK to share, somet
by hakaneskici 2y ago
How can -let's say- Cursor users be sure they were not compromised?
> No malicious usage was detected
Curious to hear about methods used if OK to share, something like STRIDE maybe?
- Centigonal 2y agofrom todesktop's report: > Completed a review of the logs. Confirming all identified activity was from the researcher (verified by IP Address and user agent).
- hakaneskici 2y agoWith privileged access, the attackers can tamper with the evidence for repudiation, so although I'd say "nothing in the logs" is acceptable, not everyone may. These two attack vectors are part of the STRIDE threat modeling approach.
- morgante 2y agoThey don’t elaborate on the logging details, but certainly must good systems don’t allow log tampering even for admins.
- deleted 2y ago[deleted]
- cdmyrm 2y agoHow confident are you that their log system is resilient, given the state of the rest of their software?
- MuteXR 2y agoFollowing that logic it would be literally impossible to trust any part of their infra. They had a bad build container, the rest of their stuff was solid.