raesene9

14 ms·

121.
by raesene9 1y ago
One useful additional aspect to Tailscale that I've not seen mentioned so far, is the integration with Mullvad. Using that you can get the benefit of their network servers, appearing just as standard Tailscale exit nodes, which is hand
122.
by raesene9 1y ago
Everything in security is a tradeoff, and unfortunately compliance risks are real risks :D That said yep corps over-complicate things and given the number of 0-days in enterprise VPN providers, it could easily be argued that they add more r
123.
by raesene9 1y ago
My own , small, experience with MSRC is indeed their bug bounty program is not good, they take any possible opportunity to avoid payouts. this means that a lot of genuine bug bounty hunters just won't look at MS stuff and MS avoid gett
124.
by raesene9 1y ago
But of course it does provide an additional layer of security that indeed could have reduced the likelihood of this issue being exploited. For me, the core of the discovered issue was that applications intended purely for use by internal MS
125.
by raesene9 1y ago
Should they? From a threat modeling perspective, what's the consequences for HN of a user having their password compromised? Are those consequences serious enough to warrant the expense and added complexity of adding MFA?
126.
by raesene9 1y ago
It doesn't have to. There's nothing to stop you using a VPN as an initial filter to reduce the number of people who have access to a network and then properly authenticating and authorizing all access to services after that. In fa
127.
by raesene9 1y ago
Weirdly Scotland is more popular with European tourists than you might think. Until recently I lived in a relatively tourist heavy part of the country, near Loch Lomond, and every summer we'd get a lot of cars from European countries
128.
by raesene9 1y ago
(speaking at least for myself) I'm not suggesting this is a good outcome, more that having seen the way many companies handle development and IT, it's quite a likely one. FWIW I'd agree that (for now at least) it's cha
129.
by raesene9 1y ago
I'm not saying more code won't be produced, I'm saying companies might only want and make money off a certain number of systems with a given amount of code, and therefore they'll need to employ fewer developers to create
130.
by raesene9 1y ago
I really don't understand why CEOs like this who are AI boosters try to justify the idea that this will create more developers, when that seems exceedingly unlikely, even if they are correct in their predictions of productivity increas
131.
by raesene9 1y ago
https://security.googleblog.com/2023/06/learnings-from-kctf-... - Has some interesting information on that topic.
132.
by raesene9 1y ago
Last I checked it's blocked by most container runtimes exactly because of the security problems, and Google blocked io_uring across all their services. I've not checked recently if that's still the case, but https:/&#x2
133.
by raesene9 1y ago
My guess is that it's your second scenario there (avoid running at a loss). In the start-up game scale/growth is the most important thing and profits really aren't that important. you want to show to later stage VCs that yo
134.
by raesene9 1y ago
I was thinking the exact thing. I used to like my Nabaztags although (from the wikipedia page https://en.wikipedia.org/wiki/Nabaztag ) it seems it was not a commercial success.
135.
by raesene9 1y ago
There's a lot of secret classes that aren't necessarily automatically scanned for. The Oops commit is a good signal that something shouldn't have been committed, even if automated scanners don't get it.
136.
by raesene9 1y ago
The point here being the blog is about looking for oops commits to spot keys that would otherwise not necessarily be picked up automatically...
137.
by raesene9 1y ago
An interesting look at one of the consequences of using git and public repo's. Does leave me wondering how long before someone has a setup which detects and tries to exploit these in real-time, which feels like it could be nasty. Also
138.
by raesene9 1y ago
Potentially for smaller players but I'd guess that the larger players (OpenAI, Anthropic, etc) won't go down that line as it'd be pretty easy to spot at the volume they're crawling and a bad look for them when they inevi
139.
by raesene9 1y ago
There's a load of really good deals on EVs at the moment from what I've seen, I'm guessing cars coming off corporate lease. From https://www.cinch.co.uk/used-cars/electric-fuel-type?fromYea... there seem
140.
by raesene9 1y ago
Now I'm a fairly cynical person by trade but that feels like it's straying into conspiracy theory territory. And of course the key point is that the author of that article isn't (IMO) working in the security research field an
141.
by raesene9 1y ago
I think consideration may have been limited by the fact that (AFAIK) Slack only provided a week's notice of this change, which has left the Kubernetes volunteers trying to act quickly to avoid losing data which isn't easily archiv
142.
by raesene9 1y ago
The key is, it's not the person who grants the MCP access who is the attacker. The attacker is some other person who can create issues on a public Repo but has no direct access to the private repo.
143.
by raesene9 1y ago
Interesting article. There is always risk that a new hot technique will get more attention that it ultimately warrants. For me the key quote in the article is "Most scientists aren’t trying to mislead anyone, but because they face stro
144.
by raesene9 1y ago
For me that's one of the great points about obsidian's choice of all notes being Markdown. Even if Obsidian vanished tomorrow and the application became unmaintainable, I'd still have all my notes in a text based format.
145.
by raesene9 2y ago
Conceptually, I don't think CSPMs are answering complicated questions, however there's quite a lot of complexity (IMO) in scaling the answers consistently, and keeping up to date with all of the tests that need to be implemented.
146.
by raesene9 2y ago
Well it depends on what you mean by "real" :) I'd say CSPM (like many security tools) can help if used well, but it's quite common to see it used as a blunt instrument, which does not help. CSPM helps to apply sets of
147.
by raesene9 2y ago
How would you say it compares to Firecracker?
148.
by raesene9 2y ago
If you want better isolation than is provided by Linux namespaces et al, then yep something like gVisor or Firecracker ( https://firecracker-microvm.github.io/ ) provide a likely better level of isolation.
149.
by raesene9 2y ago
In the case I dealt with, I was buying new Gateway PCs and they were shipping full Office Pro (including MS Access) for free with the PC. The company I worked for at the time were pretty cost conscious so there was no way they would buy add
150.
by raesene9 2y ago
Interesting article but I'm not sure some of the statements chime with how things looked at the time (IME ofc). I got involved in IT as a profession in 1995 and even then Lotus 1-2-3 and Wordperfect were going pretty well, so the idea

More ›