richbell

96 ms·

721.
by richbell 4y ago
> The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev communit
722.
by richbell 4y ago
Your blog posts were instrumental in response efforts, and it was honestly a great name (in response to a real problem, as you've mentioned), so I'll forgive you. ;) > I think the subsequent vulns (Spring4Shell, Text4Shell) jus
723.
by richbell 4y ago
Absolutely. I saw a lot of bad advice from people who thought it was only exploitable when misusing the API, similar to SQL injection, and I can see why they would think that. Unfortunately, they were wrong.
724.
by richbell 4y ago
Perhaps — explaining that to people in procurement and convincing them is months of work. Corporate procurement doesn't actually care about the risk in many cases, they care about having someone to blame.
725.
by richbell 4y ago
> My point is one shouldn't bring up Apache in the first place when talking about a project like Log4j. It's similarly irrelevant as "hosted on GitHub". That isn't comparable. - the name of the project is "A
726.
by richbell 4y ago
> What the hell is "log4jshell" that is a completely stupid name. It confers some meaning that isn't there. It's a pun on Log4J and describes the vulnerability: all you need to get reverse shell is for the application
727.
by richbell 4y ago
You're right, but this misses the point of my comment. It's a distinction without a difference for most people, and trying to clarify the structure of the foundation to executives and senior leaders (technical and non-technical) o
728.
by richbell 4y ago
Not to mention that `log.info(eval(input))` made it effectively impossible to determine if you were compromised. If you weren't vulnerable you'd see "eval(input)" in your log, however, if you were vulnerable you wouldn&#
729.
by richbell 4y ago
So is saying "The Apache Software Foundation... quickly released a patch", but the average person doesn't care about the inner workings of the foundation because, as you mentioned, everything is stamped with "Apache&quot
730.
by richbell 4y ago
> When it was first revealed in early December 2021, the Log4Shell bug was described as one of the most severe security vulnerabilities ever. > The Apache Software Foundation, which maintains the open-source tool, quickly released a p
731.
by richbell 4y ago
The author also has a thread explaining why North Korea isn't culpable for any of its aggression and the U.S is entirely at fault. I understand hating the American Empire (as it's often called), but that's an interesting take
732.
by richbell 4y ago
> Maybe the choice of language is strong but I don't think the word is being used incorrectly. My gripe is that it's manipulative rhetoric. The term "violence" evokes very specific meaning to the average person, physi
733.
by richbell 4y ago
> How do you know this individual is a member of "the left?" Did they show their membership card? A cursory glance of their posts makes it pretty obvious that they wouldn't be the type to vote Republican. I'd be will
734.
by richbell 4y ago
> Are you trying to spin a 20% wage increase as bad, somehow? No, they're saying that it doesn't go nearly far enough to address the massive inequality and poverty issue.
735.
by richbell 4y ago
I have to run out so I don't have time to write a thoughtful response. I tend to agree, but there's a glaring issue. > I would rather high tax payers get hikes in a strained economy than low wage earners. Economic welfare shoul
736.
by richbell 4y ago
That's true, and perhaps a bad example in the context of the article. The difference is orders of magnitude, so not $7 vs $100 but $10,000+. But even in my prior example your wages are increasing more and faster , and are likely to
737.
by richbell 4y ago
Perhaps I'm misunderstanding something, but I don't see how a relative metric (percentage increase) that does not account for the existing disparity is 'correct'. If I make $7/hr and receive a 100% increase, and you
738.
by richbell 4y ago
> As a group of workers, some of the lowest paid service sectors like hotel workers and restaurant workers saw some of the biggest real wage gains [1]. Not to ignore your other point, but an 18.4% increase (to $482 a week) is only a big
739.
by richbell 4y ago
Absolutely; though a slightly more cynical take is "company that currently gatekeeps payments wants to 'help' system developed to escape their influence".
740.
by richbell 4y ago
> Both can be bad, but private businesses tend to be much less wasteful than government because you have to make money or you go out of business, whereas government can waste your money without any thought of profit and just tax you more
741.
by richbell 4y ago
Relevant discussion: https://news.ycombinator.com/item?id=32195987
742.
by richbell 4y ago
> Where did you get this crazy idea? China and the US are separated by a huge ocean; there's no way to do trench warfare there. A war between the two would entirely be a naval and air war, not a ground war. That's a war the US
743.
by richbell 4y ago
> So you're saying communism can't survive in the real world where foreign intelligence agencies exist? I mean, this is an incredibly disingenuous conclusion. By that logic democracy is flawed and can never exist in South Ameri
744.
by richbell 4y ago
> At that point just rob me already what’s the point of working anymore while some lazy ass can get by without competition in this world. > What we need instead is assisted suicide for people who decided they can’t take it anymore in
745.
by richbell 4y ago
> Ahh. Armchair economics strikes again. So, your pet theory disproves thousands of years of economic evidence that draws a direct line between money supply and inflation? > Sure, if you say so. Economics is a social science, not a ha
746.
by richbell 4y ago
That doesn't necessarily answer the question of how crypto would help DNS though.
747.
by richbell 4y ago
Plenty of companies have spent the last decade trying to find alternative uses for the blockchain and failed. I know people who worked at large FIs that were dumping millions of dollars into blockchain projects led by smart people (long bef
748.
by richbell 4y ago
"It's okay babe, I developed a crippling gambling addition and gambled away our life savings ironically ."
749.
by richbell 4y ago
> HN has been talking about how Tether is a scam and how it will blow up AnyMomentNow(TM) for two years Tether managed to come back from the brink of death (user loss of confidence) by co-mingling funds with Bitfinex and getting a third-
750.
by richbell 4y ago
> I don’t hold any tether, and I wouldn’t recommend it to others. But the common opinion that Tether is insolvent might be wrong. Tether, as a stable business, is a money printing machine. I’m not sure it’d be worth risking the business

More ›