raesene9

27 ms·

331.
by raesene9 4y ago
I used to be a web app security tester. I loved it when I got an app that didn't use a framework for development because I knew I'd get some security issues for sure. In the context of web applications, frameworks mean that your d
332.
by raesene9 4y ago
I don't think they have sufficient conventional munitions to do that (as they already have dropped fire rate due to shortages), obviously they have nuclear weapons, however there would appear to be significant geo-political risks to
333.
by raesene9 4y ago
what makes you think that Russia has infinite resources? Reading reports from various parties, it seems obvious that Russia is already suffering considerable difficulties in supplying their troops. As to the goals, whilst I am not a politic
334.
by raesene9 4y ago
So there are various commercial systems that fall under CSPM (or KSPM sometimes) that are designed to assess compliance with different standards. My purely personal opinion on this is that it's difficult to do well as even with complia
335.
State of AWS Security-A Look into Real-World AWS Environments(datadoghq.com)
8 points by raesene9 4y ago|0 comments
336.
by raesene9 4y ago
This is one of the standards and compliance guides you can use for k8s. The other ones I'm aware of are - CIS Benchmarks, there's coverage for Kubeadm, AKS, EKS, GKE, OpenShift and some others. This is a compliance guide focused o
337.
by raesene9 4y ago
You're missing a major aspect of the difference now, when compared to the 80's and before, which is house affordability. Even at peak in the 1980's you were looking at house prices being 5x income at most. ( https:/&#x2F
338.
by raesene9 4y ago
By that definition of stupid, pretty much every large company in the world is stupid in someway or another :)
339.
by raesene9 4y ago
I'm not sure the "truism" that law is well paid in most plaes is true any more. In the UK for example criminal barristers have been striking due to low pay (sometimes effectively under minimum wage) Then in the US we have evi
340.
by raesene9 4y ago
It shouldn't be buzzword soup, that does not mean that companies and vendors don't use it that way. Pretty much any time a new security concept comes up vendors race to say that they implement it, whether they do or not. With Ze
341.
by raesene9 4y ago
I thought I recognized this story, then I noticed the date in the headers 1997... yep this used to get forwarded round in e-mail in the 90's.
342.
by raesene9 4y ago
If you're doing $70/hr in the UK at CISO level you're way under some of your competitors. Heck Pentesters charge more than that and they're 50%+ cheaper in the UK than the US. My hourly rate in the UK as an Big-4 Infosec
343.
by raesene9 4y ago
One anecdote from a UK internet user. I just tried googling long covid and the top result was NHS. Not sure if it is for other nationalities but they're definitely getting good ranking in the UK edit: I also tried flu and meningitis an
344.
by raesene9 4y ago
Scott/Tiger was one of my favourite ways to get access to exposed Oracle DBs when I was a pentester back in the 9i 10g era. Reliably there, not often disabled (well until after the pentest anyway), had good privileges.
345.
by raesene9 4y ago
So in theory this can fit pretty well, if you look it as a tool that can scan things at various stages of the development pipeline. As the rulesets are the same this means you can get consistent results when scanning your terraform and then
346.
by raesene9 4y ago
The page I linked gives that info for the UK :) including alternative identity proof where traditional information might be lacking. The page also lists the banks which provide the "basic bank account" service, which scanning down
347.
by raesene9 4y ago
The problem of lacking credit history has been around for a long time, I remember getting a credit card, which I paid off in full every month, just to increase my credit score ~ 20 years ago. For people without a good credit history in the
348.
by raesene9 4y ago
Of the "traditional" banks First Direct generally have quite a good reputation. I've used them for a while and they've been fine. Customer service is good on the occasions I use it and the product's been reliable. T
349.
by raesene9 4y ago
I've noticed that about Monzo. They were very early adopters of Kubernetes amongst other things, which surprised me as early Kubernetes was not exactly secure... Having seen some presentations about their tech. stack, it seems very cle
350.
by raesene9 4y ago
Given that the first recorded instance of Scottish Whisky is from 1494 (ref. https://www.glenfiddich.com/us/explore/ambassadors-blog/2014... ) I don't think Bourbon pre-dates it :P From the article it was
351.
by raesene9 4y ago
https://www.morningstar.co.uk/uk/news/225468/federal-reserve... - no quite no-one...
352.
by raesene9 4y ago
Kind of an unusual paper, they seem to mix up things like SIM swappping which are more in the area of policy with things like S3 buckets being left open (mentioned as an example on page 1) which are easily caught by CSPM style solutions and
353.
by raesene9 4y ago
It's worth noting that it is possible to disable unprivileged user namespaces, but the default on several modern linux distros is to have it enabled.
354.
by raesene9 4y ago
However mobile devices have a dual role (in many people's lives these days) as being the custodian of all their MFA setup. weakening mobile security (which this arguably may do) could have an impact there. Also "large format compu
355.
by raesene9 4y ago
Over-reliance on tools is a bad problem in Infosec, often due to the range of areas they have to cover. That said a good infosec person should always have an understanding of where their tools are limited, so they can work around those de
356.
by raesene9 4y ago
If it was an unauthenticated test, I'm not surprised. Raising findings off of banners is notoriously error prone, but pentesters often err on the side of raising things that are dubious rather than leaving them out. If it was a credent
357.
by raesene9 4y ago
More (non-paywalled) coverage https://lawandcrime.com/high-profile/delaware-chancellor-agr... It seems like not good news for Musk as he was hoping for extended discovery till next year.
358.
by raesene9 4y ago
I've been blogging a while now (~18 years), I find it worth it from a couple of perspectives. 1) Writing forces me to think through things clearly and when doing things like walkthoughs I often find things where my understanding wasn&#
359.
by raesene9 4y ago
I would sound a slight note of caution there, in that AFAIK not every camera has clean HDMI out and there can be challenges about powering cameras for longer periods of time (if needed). It is a good option though if you need higher quality
360.
by raesene9 4y ago
I'd say the problem is that no-one can easily predict where the bottom lies right now. We have Celcius with frozen withdrawals and in an undetermined state having called in restructuring specialists. We have 3ac apparently not talking

More ›