kseifried

14 ms·

91.
by kseifried 9y ago
It doesn't handle liability, and really nothing does other than the company in question doing the right thing (e.g. running a bug bounty via a well known third party and signing legal docs, or making public statements backed with docum
92.
by kseifried 9y ago
Suggested for policy inclusion for CNA (CVE Numbering Authority) guidelines. And yes, I would suggest they remove the disclosure policy, it's not really all that germane for the vendor, from the security researchers point of view. Edit
93.
by kseifried 9y ago
grep -i secret/token/phrase/key/etc and you'll often find hard coded defaults =(.
94.
by kseifried 9y ago
There will probably be more CVEs as people find other setuid apps that can be manipulated (people know what to look for now).
95.
by kseifried 9y ago
Actually no, Qualys told Red Hat and SUSE initially (I asked for early access to confirm how bad it was, Red Hat and SUSE are capable of handling very sensitive embargoed material as we have enough engineers internally to do Kernel/gli
96.
by kseifried 9y ago
Yup, it is, Qualys did some amazing work, and I suspect there are still more problems like this. So if you find stuff like this please let us (Red Hat / etc.) help you help us help everyone (I think that parses correctly =).
97.
by kseifried 9y ago
Ansible + systemd + containers is a match made in heaven. https://developers.redhat.com/blog/2017/05/04/breaking-up-th...
98.
by kseifried 10y ago
Insurance can also make existing risks more acceptable and thus lead to more risky behaviour. E.g. if someone has 0$ co-pay/deductible for car crashes they might not drive as carefully because who cares, it won't cost me anything
99.
by kseifried 10y ago
Not a gamer, but wanted a better mouse so I bought some razor mice products over the years, required internet to setup/huge bloated driver/software package, and then hardware wise the build quality wasn't there. Gave up on th
100.
by kseifried 10y ago
I have gotten several credits from AWS for under a dollar due to incorrect billing calculations on their end that they caught, notified me about and sent a credit for. So I will assume yes, they do this automatically (if they don't I&#
101.
by kseifried 10y ago
That is not true anymore. You can get a CVE from MITRE for anything (they are the ultimate root authority), and for the Open Source world you can get a CVE from the DWF ( https://distributedweaknessfiling.org ), something that is
102.
by kseifried 10y ago
Which one was this specifically? Not all local DoS's are security vulnerabilities, in general there needs to be a trust boundary that is violated, e.g. the ping of death, clearly a single remote ICMP packet shouldn't cause the sys
103.
by kseifried 10y ago
Ditto, I've poked internally, hopefully we have a reply for you to clarify this soon.
104.
by kseifried 10y ago
Stupid question but how much medicine/drugs does New Zealand produce? Does anyone produce insulin in New Zealand? What about electronics? Components to repair electronics? Cars? Car parts? Lightbulb manufacturers? I'm guessing lik
105.
by kseifried 10y ago
This is why for CVE's assigned via the Distributed Weakness Filing (DWF) Project I require a copy of the artifact, the reality is your website might go away, or get lost at sea, or deleted, or whatever. For information supporting CVE i
106.
by kseifried 10y ago
So my solution to this was to sign a ton of publicly archived email with my full fingerprint. Then I stopped signing email and not a single person noticed/cared, so yeah. Meh. CVE assignments, no big deal I guess.
107.
by kseifried 11y ago
I hate to say this but I think we need solid abstraction of the cloud providers otherwise you'll end up locked into one, and that probably won't be much fun in the long term.
108.
by kseifried 11y ago
How does this battery handle -40C weather? What about sitting at -40C for say 12 hours (not everywhere has plugins for block heaters). Currently a ~$100 winter battery will handle that no problem. I'm from Canada so this is not a hypot
109.
by kseifried 12y ago
As always Red Hat is hiring, we have hundreds of open positions http://jobs.redhat.com/ just the technical positions by major grouping: http://jobs.redhat.com/job-categories/technology/ 200+ liste
110.
by kseifried 13y ago
RHEL updates are available: https://rhn.redhat.com/errata/RHSA-2014-0376.html CentOS updates are available: http://lists.centos.org/pipermail/centos-announce/2014-April... Fedora updates are
111.
by kseifried 14y ago
Can we get that in writing and approved by Oracles legal department? Or is this some kind of personal guarantee, if so can you please spell if out exactly. Thanks. Also is it for druiid only, or the community as a whole?