raesene4

12 ms·

61.
by raesene4 11y ago
I was referring to cryptographic package signing (e.g. with PGP) so you validate the signature of the package before installing, this lets you validate that the package hasn't been modified since it was signed. curl|bash ing a script d
62.
by raesene4 11y ago
One important distinction to make is that this very much depends on what package manager you're talking about. Linux package managers tend to use signing and other mechanisms to check content. Software library package managers (e.g. np
63.
by raesene4 11y ago
The thing I don't see in this article, which I do regard as (another) drawback to curl|bash is that you're not just trusting the software developer, you're also trusting their hosting provider. Anyone who gets access to modif
64.
by raesene4 11y ago
This looks cool, although for the Windows install I'd have hoped that there would be an option to integrate Hyper-V with it instead of Virtualbox, seeing as Hyper-V is available on all Windows 8.1/10 pro/enterprise systems, a
65.
by raesene4 11y ago
You could of course read the source (although it's likely very few people do), but how do you assure that the code you download and install from the Firefox Add-On store is the same as the code that you read? As to it being computer op
66.
by raesene4 11y ago
I'd suggest that unfortunately the incentives for sites like Kickstarter/Indiegogo/GoFundMe etc are to get as many projects successfully funded as possible that that predicates against rigorous scrutiny of them and exclusion
67.
by raesene4 11y ago
exactly, I'd actually argue that Tor exit nodes are, on average, more likely to be untrustworthy than a standard ISP connection, as the incentives are there for people to run them to capture exactly the kind of traffic people want to r
68.
by raesene4 11y ago
The problem is that as Docker hub doesn't support digital signing of images uploaded to it, you are always trusting docker as well as the provider of the image, as anyone who has access (authorised or unauthorised) to their platform ca
69.
by raesene4 11y ago
Good point, it's becoming harder to know how to establish trust in projects. Particularly things like security-related software, and software which opens network ports on your systems, where there's increased impacts if it turns
70.
by raesene4 11y ago
Whilst I'm not the parent commenter I do work in the same industry.. >>These are not real infosec firms, they are parasites. >The entire consulting penetration testing market is setup to encourage this behavior. There is no wa
71.
by raesene4 11y ago
I'd be interested to hear if you have an example of a company that did read the source code of apps. used? Also which law do you think they would be breaking by not reading the source code of products used?
72.
by raesene4 12y ago
Given that in the mobile field, Android is perceived as the leader, this line of thinking doesn't really seem to hold.
73.
by raesene4 12y ago
Not sure about CPU but you can get Windows 8.1 devices with 1GB of RAM which run fine (and that's full desktop 8.1, not a cut down IoT build that this is likely to be) For me it's the lower limit of what's possible and it&#x2
74.
by raesene4 12y ago
Well I did say at the top of this thread that the proposal had glaring problems :) I was interested to hear if other people had alternate suggestions which would address the issue.
75.
by raesene4 12y ago
I'm not sure where I said hope was a strategy, I said insiders might have information that's of value to attackers (unless I got my threads mixed here)
76.
by raesene4 12y ago
Indeed, however in the same way as it's not up to you to "address" the "problem" nor is it up to me :) Doing nothing would seem like a losing response given the current swing of events but I'll defer to your gr
77.
by raesene4 12y ago
well I'm not a legislator, and if you're looking to pick holes, trust me you would be able to :) The question is, is that the best approach and if not, what is? Once an approach is agreed then the inevitable x years of wrangling o
78.
by raesene4 12y ago
BTW I'd respond to the other threads but HN seems to object to deep threads. On "flaws fixed rather than concealed" sure in a perfect world they do, but limited resources == prioritization and some systems and packages inevit
79.
by raesene4 12y ago
In this case what are the firms who pay these rates doing with the information? Defensive work (e.g. IPS vendors) well after they've got their early day protection they can just sell on to the vendor. Offensive (e.g. "cyberweapons
80.
by raesene4 12y ago
that's not what I was intending to describe. I was suggesting that insiders have inside information and sometimes that is relevant to attacking companies, such that hiring those insiders could be useful to them. and definitely not hop
81.
by raesene4 12y ago
The answer is obviously complex and difficult, but I think it's fair to say the current approach isn't working well.. So you need something new to address the problem. I think that the answer is government legislation. To be clea
82.
by raesene4 12y ago
As another slightly less draconian approach than actually trying to ban vulnerability research, what about mandating a market where researchers have to sell to the developers and developers are obliged to buy from the researcher, with a mid
83.
by raesene4 12y ago
Realistically in my experiences every large company has "skeletons", which are primarily known to insiders and of which outsiders have less knowledge. Be that a product which is known not to have as rigorous a security regime as o
84.
by raesene4 12y ago
interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place. The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substa
85.
by raesene4 12y ago
FWIW, I think that the idea of software bugs (vulnerabilities) as a product is a scary concept and a bad precedent for overall security. Once you have legitimate corporations who's goal is to find software vulnerabilities, combine them
86.
Changing Times – End of SMS Authentication?(raesene.github.io)
2 points by raesene4 12y ago|0 comments
87.
by raesene4 12y ago
I don't see it as an either/or decision TBH. I wouldn't suggest that WAFs are a panacea, but that doesn't mean that they can't be a useful defensive layer. A lot of companies have difficulties getting app. patches
88.
by raesene4 12y ago
This is a really good example of why, if you have something important to your organisation on the Internet, you need to really be doing defence in depth, to either reduce the risk of compromise, and/or increase your chance of noticing
89.
by raesene4 12y ago
Best advice I could provide if the devs aren't too knowledgeable on application security, is use a framework where possible, know where it's likely to fail you and focus there and then make sure you stay on top of patching all you
90.
by raesene4 12y ago
Cool stuff, always interesting to see a new entrant to the location services field, especially an open one. One question though. Will ordinary users be able to directly query the database via the API? i.e. if you want to geolocate a set o

More ›