raesene9

51 ms·

601.
by raesene9 5y ago
others may have suggested that, I did not :)
602.
by raesene9 5y ago
I didn't say it was worse than just password, I said it was a bad second factor, which it is. SMS 2FA was vaguely reasonable before TOTP applications and smartphones capable of running them were widely available. That's no longer
603.
by raesene9 5y ago
From a financial trading/pricing standpoint, I'd say bitcoin is centralized too, in that binance, bitfinex, coinbase and the rest of the major exchanges are necessary for the trading process. Then when you add their dependence on
604.
by raesene9 5y ago
FWIW I wouldn't regard SMS as a good 2nd authentication factor either, for the same reasons as this issue, it's too easy to get a carrier to transfer a number to an attacker. Where it's used as a second factor, this still has
605.
by raesene9 5y ago
Sure I'd guess there are multiple options for this, my point was that one (or more) would be needed for this to be practicable for small transactions.
606.
by raesene9 5y ago
It'll be interesting to see how they use BTC specifically for this use case. Looking at https://ycharts.com/indicators/bitcoin_average_transaction_f... the transaction fee for directly using BTC is $4.6 at the mom
607.
by raesene9 5y ago
Sorry, but not really surprised to see this go (for free accounts). TBH I'm surprised that they managed to keep this going as long as they have. Giving away free compute is a tricky thing to make financially viable.
608.
by raesene9 5y ago
My reading of this list is that it's not designed to be a starting point for a full security programme, but a starting point for small organizations who don't even have a security function yet. In an ideal world, every company wou
609.
by raesene9 5y ago
I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security. Whilst a security professional should take an approach like the one you describe, it a)
610.
by raesene9 5y ago
1) I was more thinking of the delivery mechanism via centralized registries (i.e. Docker pull works for anything) 2) Sure in theory, you can totally replicate docker's sandboxing with Linux security principles, however containerized de
611.
by raesene9 5y ago
For testing purposes, you can create container environments that are similar to VMs. The way I do it, is to use ansible playbooks, where the individual tasks can be run either on a VM or in a container, depending on my needs (one example h
612.
by raesene9 5y ago
There's a couple that spring to mind - Consistent packaging/execution environment. containers are delivered and executed in a standard way regardless of target env. - A level of sandboxing from the underlying host. Things like aut
613.
by raesene9 5y ago
One thing to watch out for, when using container scanning tools, is how they handle "unfixed" vulnerabilities in images based on Debian/Ubuntu. Both those distros maintain a list of CVEs that they know of but don't have
614.
by raesene9 5y ago
Depends on the country. Definitely in the UK if you make a lot of large cash transactions without a good business reason, you'll get scrutiny. This is one of the reasons that common fronts for crime are companies that would be expected
615.
by raesene9 5y ago
Klarna seems to be super popular with e-commerce sites, my guess is that there's some kind of financial incentive to the hosting site, when compared to other payment options. As to why it's popular with consumers looking at htt
616.
by raesene9 5y ago
I'd guess that's probable. Limit Hold-em is pretty mechanistic. If you play perfectly, it's pretty likely that other people at your table won't, so you'll probably turn a profit over time. The only loss is the house
617.
by raesene9 5y ago
At $2818 for the barebones, I think they've got some work to do yet to be affordable for hobbyists, but nice to see some progress :)
618.
by raesene9 5y ago
The pentesting industry has a big problem with being a good "market for lemons". It's very hard for customers to differentiate the good and bad companies, without having their own internal expertise, and even then you need to
619.
by raesene9 5y ago
IMO, one of the problems with things like the OSCP is that they don't really mirror how real pentesting works. I've never heard of a pentest that's done as a 24 hour thing where someone is watching you through a webcam and yo
620.
by raesene9 5y ago
It's an inevitable part of the way IT Audit is structured. Standards are necessarily abstract from specific systems (so don't always apply well) and updating standards is a slow process. The auditors themselves are often tasked wi
621.
CNCF Paper Defines Best Practices for Supply Chain Security(cncf.io)
1 points by raesene9 5y ago|0 comments
622.
by raesene9 5y ago
(possibly) interestingly, I pased the link to this issue into a slack, which very helpfullly got one of Github's new preview links. The image it produces can't render Zalgo either https://imgur.com/a/pOUu7m1
623.
by raesene9 6y ago
The description here https://twitter.com/charlottejee/status/1387722711766650884?... , whilst snarky, seems like a reasonable summary.
624.
by raesene9 6y ago
An (IMO) Interesting question is how to reduce the risks of things like this happening. Where evidence from IT systems is being used as a large part of a prosecution, it seems that it should have some kind of scrutiny as to how those system
625.
by raesene9 6y ago
yeah I've seen statically compiled go binaries in scratch base images before, seems to work fine. If you need some basic OS files, Google's distroless is another option.
626.
by raesene9 6y ago
I'm going to have to disagree with that statement. Containers (as implemented by Docker/containerD/CRI-O) do add security controls. Specifically, separate namespaces, restrictions on capabilities, seccomp filters and apparmor
627.
by raesene9 6y ago
Pretty much that. In addition to raw macros it has integrations for all the main streaming apps (e.g. OBS) which simplify the process of adding actions for them. So for example I can easily select scenes from OBS within the stream deck appl
628.
by raesene9 6y ago
Stream decks are really nice, I got one recently and have been playing around with various uses. So far I've hooked it up to auto-post things to a Slack (using IFTTT) and done bindings for a MMORPG (DDO) as well as it's intended u
629.
by raesene9 6y ago
- If you don't care about the layer cache, flattening the image can get rid of things from intermediate layers - If you're using buildkit, there's secret support there https://docs.docker.com/develop/deve
630.
by raesene9 6y ago
For another option, along similar lines, which has been shipping for a while now, there's https://store.planetcom.co.uk/collections/devices

More ›