raesene6

27 ms·

211.
by raesene6 10y ago
I'm afraid your suggestion that "No real company was affected by this" doesn't bear out with the evidence that I've seen or the experiences I've had in security. Real companies with real data make some pretty e
212.
by raesene6 10y ago
I'd bet they make a load of cash from all the Enterprise support agreements that there are for Solaris systems in large enterprises. The pace of change on these things isn't high, so even if the costs go up it takes a long time fo
213.
by raesene6 10y ago
For me Oracle has gone into the arena of companies like IBM and CA, where they pretty much only deal in enterprise IT scenarios and have no interest in small/end-user computing. Those companies can continue to make money on support an
214.
by raesene6 10y ago
Interesting approach to marketing, I'll give them that. Will be interesting to see how it works out for them in the medium-long term.
215.
by raesene6 10y ago
Ah no I didn't really assume that, it was part of my question, as to whether it was a deliberate strategy to jump straight to bug bounty with an expectation of a potentially large number of reported issues or an unexpected event, where
216.
by raesene6 10y ago
Yeah that's already a thing http://www.zdnet.com/article/cybercriminals-turn-talents-to-... Also monetizing security vulnerabilities by place bets on stock when disclosing has already happened http://w
217.
by raesene6 10y ago
Ahh indeed, that was kind of my initial question for the top-commentor. I'm interested in whether Shopify explored getting security consultants in to review this area before going for a bug bounty on it, or went straight to the bug bo
218.
by raesene6 10y ago
Sorry, but got to disagree with you there. I'm a security tester and have been in the industry for 15+ years either as a buyer or provider of services, for small and large companies, I've been involved in procurement of multi hund
219.
by raesene6 10y ago
So I'd be interested to know your thoughts on bug bounties as against "traditional" security reviews. Have these areas of your application been through external reviews before being opened up to bug bounty or did you decide t
220.
by raesene6 10y ago
I'm not ignoring password problems I didn't make any mention of passwords one way or the other. You seem to be ascribing views to me that I just didn't state, I'm guessing this is you assuming my world view, a common iss
221.
by raesene6 10y ago
Sorry but that's not what I read in that article, to quote "I went to strip clubs and spent hundreds of thousands of dollars on girls, alcohol, cocaine and whatever else." that's not the actions of someone who just overd
222.
by raesene6 10y ago
I didn't say I thought key based logins were bad, but that not allowing a password login during setup made it more awkward for people trying out CoreOS to test. That said I wouldn't say that SSH key based login were necessarily gr
223.
by raesene6 10y ago
I'm guessing they're shooting for a name assocation thing here, the same thing that Microsoft pulled off with SQL Server associating the generic term with a specific product. However as others have said, searchability for that pro
224.
by raesene6 10y ago
And you don't think that's a sophistry? Let's be honest he knew full well the bank, if actually asked, would not have approved his borrowing, any reasonable person would. He took advantage of a mistake made by an automated sy
225.
by raesene6 10y ago
well in the UK when you want to take out a loan, the bank is legally obliged to look at your ability to repay and not loan you the money if you don't appear to have the ability to repay. Home owners have collatoral, business have busi
226.
by raesene6 10y ago
Whilst IANAL, it would seem logical that a court would look at whether the defendant could reasonably have expected to be able to pay back a loan. If I have a say $50k/year job and borrow say $200k I could reasonably have expected to p
227.
by raesene6 10y ago
That's easy, he had no money to pay it back, ergo it's fair to conclude he had no intention of paying it back. It's one thing to go a couple of thousand overdrawn, quite another to spend $2 million when you have no source of
228.
by raesene6 10y ago
I didn't see any indication in the article that the bank knew, and as there is no way this loan would pass their audit checks, I really doubt anyone got commission for it. My guess would be a mistake in a system and a line of credit go
229.
by raesene6 10y ago
It's a two party situation if both parties are aware of it. I didn't read any implication in the article that the bank knew about this, it was a mistake either human or software that led to him having the credit line. so only one
230.
by raesene6 10y ago
Except that's not what appears to have happened here. I didn't see any suggestion in the article that the bank knowingly lent out the money, most likely a human error or bug in one of their systems caused his account to have this
231.
by raesene6 10y ago
If you're running a commercial entity and $50/year is a problem for you, then I'd suggest that your business may have its challenges. Obviously it is (in most cases) possible to automate the cert creation process using let&#
232.
by raesene6 10y ago
I've done many password audits over the years and all monthly password changes does it make people use sequence passwords (e.g. MyPass1!, MyPass2!, MyPass3!) which are easily guessed by the attacker once they have one instance of the s
233.
by raesene6 10y ago
I'm not sure I'd call ~$50/year ( e.g. https://cheapsslsecurity.co.uk/comodo/positivessl-wildcard.h... ) a "huge monetary subscription fee"....
234.
by raesene6 10y ago
For me keybase solves a lot of the WoT problem but not the day-to-day usuability problem. The killer is lack of good x-platform e-mail integration + difficulties in key management. I was hoping keybase might take that on as well, but AFAIK
235.
by raesene6 10y ago
I believe a lot/all of their stuff is, github repos here https://github.com/keybase
236.
by raesene6 10y ago
err in that attack how do they know your original password to change it back? and if they know your password to change it back why bother changing it in the first place, why not just log in as you? AFAIK the reason for password history is
237.
by raesene6 10y ago
There absolutely is a trade-off here between freedom to operate and likely security (with the exception of highly skilled technical people with a lot of time on their hands, who can likely have both). Personally I'd say that most non-t
238.
by raesene6 10y ago
Depending on your use case, that may not be such a great idea. Unless Red Hat have back-ported it, 1.10 misses several important security advances that have come into Docker in recent versions...
239.
by raesene6 10y ago
From the spec page http://www.smartisan.com/en/m1/#/specs it appears their OS is based on Android.
240.
by raesene6 10y ago
As to 2. Either the CEO did know, or he should have known. The bank's internal audit teams must have known (they would have reviewed staff activities as they always do for fraud, and the idea that they had missed this for many years i

More ›