raesene9

34 ms·

451.
by raesene9 5y ago
I have a feeling companies in the US will have difficulty filling CISO roles without offering golden parachutes (which kick in if the CISO is let go after disclosing a breach) in future. In cases of breaches there will often be commercial p
452.
by raesene9 5y ago
It knows classic songs to! Started with "we're no strangers" and it knew the score.
453.
by raesene9 5y ago
Unfortunately I don't think that 2-5 instances of this will produce any change. We've seen more than that number of actual malicious package takeovers in the last couple of years and it has produced basically no real change. heck
454.
by raesene9 5y ago
The thing is, intent isn't always clear and oftentimes Github are unlikely to have all the context needed. It's easy to determine with simple examples, the real world is often messier. For example in that first case, say all they
455.
by raesene9 5y ago
I'm sure this case is clear, my point was around the wider principal that by going down this line GH set themselves up as arbiter of "malice" To take a trickier example, say a GH user has a lib, then decides to re-architect i
456.
by raesene9 5y ago
That seems like a bit of a shaky ground to stand on for GH. If someone publishes code for themselves, and at no time asks anyone to take it as a dependency, then at a later date they change that code in a way that breaks other people's
457.
by raesene9 5y ago
oh I'd absolutely agree that a random nginx install is likely to be better than many browsers, but nginx has had years and years of attacks directed at it, so will be a very well hardened target. What I was thinking of, when looking ba
458.
by raesene9 5y ago
Servers are directly attackable over the internet, unlike browsers :) Browsers are a very well hardened target at this point after decades of attacks. The fact that browsers still see exploitation, despite the money spent on their security
459.
by raesene9 5y ago
It's interesting that the article touches on the reasons why end users might not want to run servers but doesn't mention at all one of the ones that comes to my mind most quickly, which is security. Running a production server on
460.
by raesene9 5y ago
So, if you don't own the copyright and then mint an NFT, in theory the copyright holder could get the source image for your NFT taken down (depending on where it's hosted of course) That hasn't stopped loads of NFTs of copyri
461.
by raesene9 5y ago
In many cases you don't even need to modify it. Ownership of an NFT often does not provide copyright on the original image ( https://www.wipo.int/wipo_magazine/en/2021/04/article_0007.h... has some
462.
by raesene9 5y ago
They're missing some names there. An article about the most powerful people in crypto(currency) and they don't mention Bitfinex/Tether at all?
463.
by raesene9 5y ago
If I can make a couple of suggestions for winning over that crowd. 1) As OP said, dial back "never" statements, there's no such thing as perfect security :) 2) When I look at a solution like this which essentially requires a
464.
by raesene9 5y ago
The major risk here probably isn't in-house developed code but versions of log4j used in a vast array of packaged software and systems. https://github.com/cisagov/log4j-affected-db <-- that's a (probably i
465.
by raesene9 5y ago
There are indications ( https://twitter.com/dlitchfield/status/1469199750452822017?s... ) that log4j1 can be affected too...
466.
by raesene9 5y ago
this is true but if the details in this post https://news.ycombinator.com/item?id=29456593 and others in that thread are to be believed, they have some serious security problems.
467.
by raesene9 5y ago
audits are a signal for sure, but can an end-user tell a good audit from a bad audit? Also as monox (who got hacked this week) shows 3 audits this year are no guarantee https://docs.monox.finance/library/audits
468.
by raesene9 5y ago
The problem with crypto users "taking the risk they're willing to take" is that there's very little reliable information about which projects have better security than others. Every project will say that they have great
469.
by raesene9 5y ago
Container volume mounting has been a source of quite a few CVEs recently. CVE-2021-30465 in runc ( https://github.com/opencontainers/runc/security/advisories/G... ) and CVE-2021-25741 in the Kubernetes ku
470.
by raesene9 5y ago
If a bank defrauds you in the UK you generally get the money back, there have been multiple cases. As to them having your money, that's what capital adequacy controls (another form of regulation) are for. banks are required to keep a p
471.
by raesene9 5y ago
Ok another one. In the UK we have a Financial services ombudsman https://www.financial-ombudsman.org.uk/ which can mediate in any dispute a customer has with a bank. So if a bank takes funds or won't release funds, the
472.
by raesene9 5y ago
meh, there have been multiple occasions where either rollbacks have happened (maker DAO https://levelup.gitconnected.com/how-ethereum-reversed-a-50-... ) or exchanges have frozen stolen coins.
473.
by raesene9 5y ago
So one example, in the UK if my bank goes bust then up to £75k I get my money back. This is funded by a levy on all the banks.
474.
by raesene9 5y ago
Well they'll pinkie swear they don't take US customers, whilst ignoring VPNs and other mechanisms of appearing not to be in the USA, at least...
475.
by raesene9 5y ago
Funny you say that as one of k3s main difference to general Kubernetes is that it supports the use of sqlite instead of etcd, whereas kind is straight kubeadm clusters in Docker containers, so uses etcd... I see the two projects as covering
476.
by raesene9 5y ago
The thing is , that side of things in practice, isn't really decentralized. Where do you buy and sell those "shares"... exchanges (e.g. binance, coinbase, bitfinex etc), which essentially just replace the centralized stock ex
477.
by raesene9 5y ago
And this is why regulation of private corporations is a necessary evil, to provide an incentive to corporations to treat their customers better...
478.
by raesene9 5y ago
Yep exactly part of the problem, if such a thing occurred you'd be weighing off a short term apparent gain with a very real risk of it leading to more problems down the line.
479.
by raesene9 5y ago
An interesting thought experiment is, what's the correct public health response if it appears that Omicron is more contagious but less serious than Delta, and catching Omicron is mutually exclusive with catching Delta or any other stra
480.
by raesene9 5y ago
Learning Management System - manages training, students etc

More ›