spydum

48 ms·

511.
by spydum 9y ago
The actual source list: https://www.dol.gov/whd/immigration/H1BDebarment.htm "The Wage and Hour Division maintains the list below of willful violator employers under the H-1B program." One really odd sta
512.
by spydum 9y ago
Not an nginx user here, but I do know sometimes certain modules in Apache will add significant latency on POST payloads by waiting for the entire POST payload to complete before sending to the backend (in a reverse proxy setup). The idea is
513.
by spydum 9y ago
stand up an old version of wordpress with poor admin/admin credentials on an external box, and wait a couple hours. You'll find all sorts of malware on a linux box. ransomware included. Pretty common, though it seems most people w
514.
by spydum 9y ago
Some good stuff in here: have been spending a lot of think time on this problem, so this was helpful to validate some thoughts. but you lost me when you went talking on about XACML. Does anybody use XACML still? I feel like that is a dinosa
515.
by spydum 9y ago
I think you don't hear about the sudo variant because it's almost never used (though I'll be honest, I never considered impersonating sudo, going to have to add that to my bag of red team tricks). I think impersonating UI&#x2
516.
by spydum 9y ago
That level and timeline of response tells you a great number of things, regardless of the source: 1) they had a plan for breaches (it would be hard to cover all the ground without one) 2) they had technical controls/capability to respo
517.
by spydum 9y ago
https://codahale.com/a-lesson-in-timing-attacks/
518.
by spydum 9y ago
That last paragraph will seem familiar to anyone running prior versions of Windows... What an ironic turn of events!
519.
by spydum 9y ago
My prediction: tax return fraud is going to spike for 2017 returns. All other forms of identity theft profiteering are too high touch.
520.
by spydum 9y ago
It seems dishonest to pretend struts was their only problem. That just happened to be the trick of the day. As others have mentioned, security is designed in layers. The fact that a single layer can fail and cause so much damage is simply b
521.
by spydum 9y ago
He isn't excusing it, he's making this point this is far more common, and if you looked at any of the fortune 100, in sure you will find the same or WORSE practices. I agree with his assessment, I just wish it was otherwise. Many
522.
by spydum 9y ago
Sort of disagree.. HTTP (and HTTPS by extension) have become the veritable Swiss Army knife of the internet. It's not just for hypertext anymore.
523.
by spydum 9y ago
you must not work in enterprise space. so much FTP, its sickening..
524.
by spydum 9y ago
I believe the more recent vulnerability doesn't apply to the atlassian tools (I'd love to know if I was mislead). My understanding was the latest struts vuln requires you to be using a specific REST plugin.
525.
by spydum 9y ago
im pretty sure the maths doesnt work out in favor of this. it'd be more efficient to simply insulate the roof better, than to try to capture solar power.. but maybe I'm wrong.
526.
by spydum 9y ago
pretty sure the responsibility of announcing that sort of thing goes to chief risk officer, or legal -- not usually technology. though clearly they failed in some way (security training, sdlc process, m&a due-diligence, or whatever)
527.
by spydum 9y ago
Very likely wanted to keep that potential revenue stream in their back pocket for when things got tight
528.
by spydum 9y ago
Exactly this. I have seen hundreds of systems built by experienced gray beard Unix admins, which have been steady as rocks, some lasting 15+ years without ever a peep of trouble. however I have seen many "new" boxes built by &quot
529.
by spydum 9y ago
You missed the point: if I take an image backup of a disk and store it, even in encrypted format, and it contains John Doe's account, and he comes along and asks for his account deleted, I would have to purge not just my database recor
530.
by spydum 9y ago
Users might feel like adding a monetizing strategy to existing "free" is Reddit selling out. Whereas if you just add a "new" feature and monetize that, people are less likely to rebel
531.
by spydum 9y ago
Others have touched on this: the concept of a protected class seems odd when faced with the idea that all people are to be afforded equal protection under the law (14th amendment)
532.
by spydum 9y ago
I have read many of the threads here, and I think it boils down to this: do businesses (NOT THE GOVERNMENT) have the right to choose what content and customers they serve? Further, does it matter if they are a hosting provider? A network pr
533.
by spydum 9y ago
widely assumed 5nm is the limit. I know i've seen others discuss some ideas around how close they can get, but i'm struggling to find the thread.. In any case, this may help: https://en.wikipedia.org/wiki/5_na
534.
by spydum 9y ago
fully agree here. If you can't put aside your personal feelings based on someone elses political views to get work done, YOU are the one with the problem. I'm sure plenty of us have worked with people who have lifestyles, beliefs
535.
by spydum 9y ago
yup, smart dude, learned plenty as a self-taught network grunt subscribed to nanog in the 2000-era and hanging out on irc, listening to guys like rs
536.
by spydum 9y ago
As many large enterprise shops migrate to cloud, they need a way to handle data classification and sprawl in their s3 buckets. Magic tools that can label data for them is more useful than nothing, and those big shops wont blink at the price
537.
by spydum 9y ago
Could this comment alone be considered infringement and be subject itself to a DMCA takedown? You are instructing someone how to potentially bypass security measures for copyrighted works? /s
538.
by spydum 9y ago
I have seen this pattern repeated in many large companies. One big product is successful and builds a nice PR bubble. Executives pile on anything they had in the pipeline with a re-brand, diluting the new brand. I wonder what the solution i
539.
by spydum 9y ago
I dunno, I'm pretty sure defense* would easily be able to paint the picture that employee spent hours researching and writing an article because he cared about the culture. If you didn't care, you wouldn't be bothered to inve
540.
by spydum 9y ago
Executives who make hasty hot headed decisions are not the guys you want steering the ship, regardless of what the popular caricatures you see on TV.

More ›