spydum

37 ms·

211.
by spydum 5y ago
Late to reply but the answer is services are different than desktop software. Azure services fall under a rigorous compliance regime and pentesting (3rd party even) is part of that. Just goes to show compliance does not always mean secure.
212.
by spydum 5y ago
This is a common problem, if your only method of communicating with your customer is compromised (email), then you have no action except account disablement and require contact support some how, or accept the abuse.
213.
by spydum 5y ago
Same, but I'm curious why you think it's encrypted at all? Also makes me curious how resistant to crypto attacks satellites would be, given all the various failings and gotchas with terrestrial tech and tls and others.
214.
by spydum 5y ago
I'm sure it was pentested, but the problem is pentesting quality can vary wildly. Hard to know if you have a great tester or a great dev team.
215.
by spydum 5y ago
to be fair ms azure has a nice login experience for their cli tool (imho anyways).
216.
by spydum 5y ago
opnsense has auto updates, and they are pretty painless. highly recommend it.
217.
by spydum 5y ago
Smallstep attempts this, but I agree with everything you have said.
218.
by spydum 5y ago
Sounds a lot like threat modelling. It's great, if you are creative enough to imagine all the threat scenarios.
219.
by spydum 5y ago
Most MFA solutions are vulnerable to attack because there is a real challenge handling enrollment and lost tokens. It requires verification of the user, which guess what? Hard to do especially with remote users.
220.
by spydum 5y ago
Pretty sure kofax road is just KaPow acquisition, but yes.
221.
by spydum 5y ago
I've often used fail2ban not as a security control, but a log hygiene solution. I don't need 10000s of failed login attempts in my logs, it's annoying. I have full faith it's not stopping a server compromise, but it abso
222.
by spydum 5y ago
Agree, buying sampled Netflow data would technically hit this bar. Hard to know if it is troublesome without knowing the purpose. Are we using this for analyzing citizens traffic and correlating with other identifiers... Or are we analyzing
223.
by spydum 5y ago
Public relations, mostly.
224.
by spydum 6y ago
So you think local IT can acheive the same high availability and elasticity? Sorry that isn't usually my experience. Lots of anecdotal local IT get lucky, but on average I think this is the wrong lesson to learn.
225.
by spydum 6y ago
And own huge chunks of the enterprise market (and customers are generally happy at least in my circles).
226.
by spydum 6y ago
Incredibly unfair, the character assassinations are totally uncalled for. The infosec community has a real problem with tearing each other apart. So much so, that journalists now also think it's okay. * Just a reminder, they were teari
227.
by spydum 6y ago
I thought the exact same thing. I suspect a better definition would be a wager based on random chance. Markets aren't "random", they are just suitibly complex enough to seem like it. Some people apply algorithms and emotional
228.
by spydum 6y ago
wow havent seen that hardware (baystack 350T!) in a really long time! maybe even an extreme networks switch in there. Must have been mid-late 90s photos I'd guess
229.
by spydum 6y ago
that's a service delivery problem, just like when a restaurant runs out of a popular dish. Go to another broker.
230.
by spydum 6y ago
What you need is a second drone..
231.
by spydum 6y ago
Or you know, upgrade to windows 10, since windows 7 has been dead for about a year now.
232.
by spydum 6y ago
I think amazon offers a mechanism on your Amazon linked devices of sharing wifi credentials. If you had ever fired up an amazon fire tablet or something and connected to that hotspot, the fire STICK may have accessed the wireless history an
233.
by spydum 6y ago
I don't understand.. drivers licenses dob and all of this info is already public record in many states. Why is this so alarmist? Most states have searchable court records, so if you ever so much as had a speeding ticket it will usually
234.
by spydum 6y ago
Isn't this what OPNsense or pfSense are essentially, just with a web ui?
235.
by spydum 6y ago
Probably not. I think the intent is for big shops to quantify the risk of adopting an open source project. This is just a way to codify how teams justify whether a project is "mature enough" for adoption.
236.
by spydum 6y ago
I think you miss the point then. The things it's looking for are indicators security practices are even in place. If you wanted vuln scanning, many solutions for that today exist. This is almost like a reputation score. The higher it i
237.
by spydum 6y ago
I think they meant it would autoinvalidate the tokens which might be valid. I think the math on an AWS secret and access key would be ridiculous to brute force.. but other types of keys might be an interesting attack vector.
238.
Chrome to provide its own Cert Authority store(chromium.org)
3 points by spydum 6y ago|0 comments
239.
by spydum 6y ago
Seems like microsoft has a real issue tracking their cert expiry lately
240.
by spydum 6y ago
Interesting, I knew about binwalk as it's fun to poke at IOT firmware updates and find vulns, but never knew about binwalk pro

More ›