3 ms·

Looking for and finding bugs and security issues with SAP can consume your time 24/7. When left a fortune 500 company 2 years ago, many SAP processes were runn

by jmclnx 2y ago

Looking for and finding bugs and security issues with SAP can consume your time 24/7. When left a fortune 500 company 2 years ago, many SAP processes were running in background on UN*X with these arguments: -u USERID -p PW As a developer I informed the admins a couple of times over the years, the response was "wow, will check it out". But they ran into a mountain of red tape and gave up. So nothing was ever done. But as a developer and support person, at least I had a way to fix things without falling into the bureaucracy quicksand. FWIW, I only had to do that twice over a 10 year period around Q/E.

depierre 2y ago
SAP can mean so many things that it's easy to get lost in the weeds, and I'm just talking about getting familiar with their landscape... While working on that post, I found new vulnerabilities that SAP is now addressing. I'll be honest, I've never been on the other side dealing with red tape. It'd probably drive me mad. But from the researcher/consultant side, it's definitely gotten easier to report vulnerabilities. Vendors now have security contacts, coordinated disclosure policies, and even bug bounty programs. Not all vendors, of course. But compared to 10 years ago, it's night and day.
- hinkley 2y ago
  From personal experience, CERT advisories can help cut a lot of red tape. A lot of the wishful thinking and inertia evaporate once the public disclosure goes out. That is a big part of why there’s so much support for the disclosures. People like me and GP see how little progress gets made without the “Press”.
  - depierre 2y ago
    It's really about striking a balance: giving vendors a fair chance to patch, while also not leaving users in the dark indefinitely. That's also why the 90-day disclosure policy has become common in the industry (e.g., Google's Project Zero). I've had cases where I tried reaching out via email, LinkedIn, Twitter, you name it, and got radio silence for months and months. Then, when you make the difficult decision to go public, the vendor finally reacts... That sudden urgency only shows up when there's a bit of spotlight.
hinkley 2y ago
Like using a push broom to keep the flood at bay. I didn’t realize that SAP was already 12 years old when The Goal was published. And that was a company whose origin story was a divestiture to IBM from Xerox and some of the projects getting cancelled. I had it in mind based on commentary added to the anniversary edition of The Goal that the whole field of ERP started in the 80’s but it seems that was more correct to say that’s when it exploded, not where it started.
philjohn 2y ago
My favourite experience of SAP was a guy I worked with who was part time, 4 days a week. It always did odd stuff to the rounding of his accrued annual leave - like saying he had 0.99 days left to take, when he actually had a full day.
- seangrogg 2y ago
  Floating point math strikes again.

by jmclnx 2y ago

depierre 2y ago

SAP can mean so many things that it's easy to get lost in the weeds, and I'm just talking about getting familiar with their landscape... While working on that post, I found new vulnerabilities that SAP is now addressing. I'll be honest, I've never been on the other side dealing with red tape. It'd probably drive me mad. But from the researcher/consultant side, it's definitely gotten easier to report vulnerabilities. Vendors now have security contacts, coordinated disclosure policies, and even bug bounty programs. Not all vendors, of course. But compared to 10 years ago, it's night and day.

hinkley 2y ago
From personal experience, CERT advisories can help cut a lot of red tape. A lot of the wishful thinking and inertia evaporate once the public disclosure goes out. That is a big part of why there’s so much support for the disclosures. People like me and GP see how little progress gets made without the “Press”.
- depierre 2y ago
  It's really about striking a balance: giving vendors a fair chance to patch, while also not leaving users in the dark indefinitely. That's also why the 90-day disclosure policy has become common in the industry (e.g., Google's Project Zero). I've had cases where I tried reaching out via email, LinkedIn, Twitter, you name it, and got radio silence for months and months. Then, when you make the difficult decision to go public, the vendor finally reacts... That sudden urgency only shows up when there's a bit of spotlight.

hinkley 2y ago

Like using a push broom to keep the flood at bay. I didn’t realize that SAP was already 12 years old when The Goal was published. And that was a company whose origin story was a divestiture to IBM from Xerox and some of the projects getting cancelled. I had it in mind based on commentary added to the anniversary edition of The Goal that the whole field of ERP started in the 80’s but it seems that was more correct to say that’s when it exploded, not where it started.

philjohn 2y ago

My favourite experience of SAP was a guy I worked with who was part time, 4 days a week. It always did odd stuff to the rounding of his accrued annual leave - like saying he had 0.99 days left to take, when he actually had a full day.

seangrogg 2y ago
Floating point math strikes again.