raesene9

51 ms·

631.
by raesene9 6y ago
All good points, I'd add one more. Make sure you have detection and response capabilities. Many attacks go from an initial point of compromise to find and attack target information. If you can detect this activity early, it might be po
632.
by raesene9 6y ago
http://icanhazip.com/ is my favourite one of these services, for simplicity and also as I can always remember the URL :)
633.
by raesene9 6y ago
So the challenge even for someone like MS is, how far down the line do they go. Do they do a one-time review, problem there is it won't catch new issues. Do they provide PRs for fixing issues found, that's another level of complex
634.
by raesene9 6y ago
As far as I'm aware, distros are not doing security review of all the packages they include. I'd be pretty surprised to find out that they have the kind of resources needed to do code review of even a small percentage of their pac
635.
by raesene9 6y ago
No one (that I'm aware of) has managed to make a successful business of "curated" packages (interested to hear if there are any). You get companies doing things like version checking and basic scans for malware, but that woul
636.
by raesene9 6y ago
So one example would be. Say you have a web application which makes HTTP requests on your customer's behalf (something like a website availability checker) You want customers to be able to enter host IPs that they control and your site
637.
by raesene9 6y ago
It's always been a surprise to me how (generally large) companies can rationalize this kind of behaviour. I remember the first time I came across it, I saw a project that was going to install detailed monitoring on call centre workers
638.
by raesene9 6y ago
yeah it's definitely still worth checking where the local cabinets are and distance to any property, but it's possible to get good Internet in most areas, and property (outside of places like Skye that are super-popular with touri
639.
by raesene9 6y ago
4G in the highlands has massively improved in the last 5 years thanks to the ESN project. The area I live in (west highlands just past the Rest and be thankful) has good 4G coverage anywhere in the village and even on the road up to the A83
640.
by raesene9 6y ago
So Anecdata for me. I live in the rural west highlands in a village of 200 people. I have 900/100 FTTP and 4G connectivity is available anywhere in the village on EE. With lack of contention you can get 100Mbps down stream over 4G I di
641.
by raesene9 6y ago
There's a site here https://gpl-violations.org/news/ which has some cases where there have been legal actions related to GPL violations.
642.
by raesene9 6y ago
Unless you've got the money for FTTPoD ofc :)
643.
by raesene9 6y ago
That was my first thought, where's the server-side validation that the amount submitted is in-line with what the UI showed. In this case it was higher than the UI stated, but what happens if it was lower...
644.
by raesene9 6y ago
In addition to Dive, there's also Whaler https://github.com/P3GLEG/Whaler which will print out a Dockerfile from the image, based on the metadata in the image. You can also use Portainer https://www.por
645.
by raesene9 6y ago
Yeah there's a suite of things that can come out of this (I think) as it's more commoditized. For me though the biggest part is the Security Vulnerability-->money pipeline. We know there are a load of vulnerabilities in softwar
646.
by raesene9 6y ago
I thought this was a really interesting look at the commercial end of ransomware. Clearly shows that as an attack class it's not going anywhere for the time being and it'll just be a growing issue. With the amounts of money being
647.
by raesene9 6y ago
I don't think I've seen that exact logic, but it probably could be implemented via scanners that have a "white-list" feature. you could build lists of things you know about but don't want flagged, but I'd guess
648.
by raesene9 6y ago
There is a list of CVEs available via NVD or similar, however the challenge for a scanner is "how do I know if the binaries I'm seeing have been patched" The common way to do that is to lean on the linux distribution's p
649.
by raesene9 6y ago
Alpine is useful, but there are some things to watch.Specifically it has quite a short support lifecycle, so if you don't bump the tags it'll get out of support quite quickly.
650.
by raesene9 6y ago
well I'd say there's a difference there, I guess between "no patch but CVE" and "no known CVE" :)
651.
by raesene9 6y ago
AFAIK the reason it's different is that Debian/Ubuntu publish lists of unpatched CVEs but I don't believe that RH do. What scanners are often doing is pulling the published Sec-db for a distribution and using that as their da
652.
by raesene9 6y ago
This article shows an interesting contrast between how different types of scanning tools address the issue of valid CVEs for which there are no updates. The question is "do you want to know about a valid CVE if there's no patch av
653.
by raesene9 6y ago
Linux capabilities are an interesting area, with some nuances (like ambient) which can be a bit unobvious at first glance. Adrian Mouat did a good deep dive post about them and some practical examples of using capabilities . https:/&#
654.
by raesene9 6y ago
It's quite possible in pentesting to end up hitting the wrong target unless you're careful. Not as extreme as this case but, I've had cases where customers gave me the wrong IP address range for external work in the past, or
655.
by raesene9 6y ago
The register article on this https://www.theregister.com/2021/02/11/microsoft_azure_ubunt... has responses from Canonical and MS, which shed a bit more light on the situation. The Canonical quote is the most
656.
by raesene9 6y ago
Having a vibrant banking sector has been a point of pride for London for a long time. It's got benefits in terms of bringing in tax money, both directly from the companies and indirectly from their employees. If you're known as a
657.
by raesene9 6y ago
This kind of news really isn't that surprising. What's concerning (if you're from the UK) is that unfortunately the current government don't seem keen to admit the reality of the impact to trade that brexit will have. Wi
658.
by raesene9 6y ago
Rootless docker only left experimental status with 20.10 which came out in December 2020, so maybe they would have addressed some of those issues... As to swarm, I was comparing Docker rootless to podman, which is more a developer use case
659.
by raesene9 6y ago
FWIW you can run Docker rootless (as an ordinary user) now.
660.
by raesene9 6y ago
Docker does allow for daemonless execution, but as you say one daemon per user will add a bit of overhead. There's some tradeoff I guess though, between rootful setup and per user, as images duplication per user could add up.

More ›