niros_valtos

10 ms·

61.
by niros_valtos 5y ago
Hackers for Charity, led by Johnny Long (author of Google Hacking)
62.
Ask HN: How do you manage PR approvers in GitHub?
2 points by niros_valtos 5y ago|0 comments
63.
GitHub services are degraded again?(downdetector.com)
5 points by niros_valtos 5y ago|0 comments
64.
by niros_valtos 5y ago
There is no answer that fits everyone. I wouldn't try to take the hands off from the technology - Elon Must is still the key engineer at his companies. Instead trying to build yourself as an executive, try demonstrating more leadershi
65.
Show HN: Need a quick GitHub test infrastructure? GitGoat will do it for you(gitgoat.tools)
2 points by niros_valtos 5y ago|1 comments
66.
by niros_valtos 5y ago
The problem isn’t using one tech or another, but the fact that malicious extensions can be installed and we cannot detect it.
67.
by niros_valtos 5y ago
Can it be identified only in a PR or is there any tool that can search through all forks? Maybe it’s too small problem to solve though.
68.
Ask HN: Mono-Repo or Multi-Repo?
18 points by niros_valtos 5y ago|16 comments
69.
by niros_valtos 5y ago
This is cheating, even if you just want to kickoff your company to build trust.
70.
Two Active Directory Bugs Lead to Easy Windows Domain Takeover(threatpost.com)
4 points by niros_valtos 5y ago|0 comments
71.
Conti ransomware gang weaponized Log4j2, now with a full attack chain(threatpost.com)
3 points by niros_valtos 5y ago|0 comments
72.
by niros_valtos 5y ago
Results from these tools typically go to the developers, not to the PR reviewers. They see only the result of fixing a vulnerability, and if there is a new vulnerability introduced, these static code analysis tools should detected them befo
73.
by niros_valtos 5y ago
Saw this link here in the past. Didn’t pickup. The reason why I don’t like it is that random people, regardless their expertise, cannot just review PRs and understand the impact of the change on the system without being deeply involved in t
74.
Third High Severity CVE in Log4j Is Published(logging.apache.org)
432 points by niros_valtos 5y ago|312 comments
75.
by niros_valtos 5y ago
It depends on the age of the company and the size of the products. A typical startup company can kick the tires with a monolithic architecture just to deliver a prototype quickly, but a more stable company that builds a products to scale wi
76.
by niros_valtos 5y ago
Can be a nice tool to identify website defacement or API degradation
77.
by niros_valtos 5y ago
I really like your content. Well done! Here is another good one that complements your article: https://blog.arnica.io/hacking-hacker-news-for-fun-and-profi...
78.
by niros_valtos 5y ago
Looks like this article gives a false sense of accountability, for example the inability to introduce a breaking change. Well, the change that fixes this vulnerability is a non-breaking change, so it could’ve been fixed earlier.
79.
by niros_valtos 5y ago
A book that has a major impact on me is “Start with Why” by Simon Sinek. It would be great to emphasize why people do what they do as the entire company strategy depends on it. Other important topics is identifying the big pain and why it n
80.
by niros_valtos 5y ago
Did anyone run the log4j RCE search?
81.
by niros_valtos 5y ago
It depends on the audience you are targeting. If it is the audience on HN, here is a good way to do it: https://blog.arnica.io/hacking-hacker-news-for-fun-and-profi...
82.
by niros_valtos 5y ago
You can post here, Reddit, Discord, or other social media you find useful. Additionally, if you like what they do, star them on GitHub.
83.
Failing builds in the CI/CD pipelines due to security vulnerabilities?
1 points by niros_valtos 5y ago|0 comments
84.
Pegasus Spyware Infects U.S. State Department iPhones(threatpost.com)
2 points by niros_valtos 5y ago|0 comments
85.
Stack Overflow Developer Survey 2021(insights.stackoverflow.com)
1 points by niros_valtos 5y ago|0 comments
86.
How Is AI Accelerating DevOps?(sysadminxpert.com)
3 points by niros_valtos 5y ago|0 comments
87.
by niros_valtos 5y ago
I wonder why the developer had access to so many resources on AWS and GitHub? Can’t these excessive permissions be removed? Why it was undetected for such long time?
88.
Ubiquiti developer charged with extortion, causing 2020 “breach”(krebsonsecurity.com)
388 points by niros_valtos 5y ago|228 comments
89.
AWS SageMaker Jupyter Notebook Instance Takeover(blog.lightspin.io)
2 points by niros_valtos 5y ago|0 comments
90.
by niros_valtos 5y ago
It doesn’t find malicious packages but vulnerable packages. There is a major difference between these 2.

More ›