clwg

No big company is going to agree to the terms and conditions that are listed on their website, they'll have their own schedules for indemnification that CS would agree to, not the other way around. Those 300 of the Fortune 500 companies are going to rip CS apart.

Not just QA; security assurance, code reviews, static and dynamic testing, threat surface analysis, unit testing, and pentesting either didn’t exist or weren’t sufficiently applied.

I have to imagine that this bug has existed for quite some time and I’d be curious to know what other input validation errors they have, considering the amount of untrusted input they evaluate at ring 0 originating from userland.

I clicked hoping to see Smoke on the Water mentioned, and there it was right at the start.

I'm always curious on how security software can provide a ROI.

I had McAfee tell me one time that the hackersafe logo on our website would increase sales by 10%, this was at a Fortune 50 doing billions in sales online every year.

I was pretty hyped because it would have done wonders for my career, but then they walked it back and wouldn't explain it to me. I wasn't mad, I was disappointed.

This makes me sad, I haven't thought about Bob Newhart in years, he was a ever present fixture on TV my entire youth.

As soon as I saw the headline, the only thing that popped into my head was, "Hi, I'm Larry, this is my brother Darryl, and this is my other brother Darryl!" with Bob maintaining a straight face the entire time in front of a audience.[0]

Class act all the way. I wish we had more celebrities like him and Betty White nowadays.

https://www.youtube.com/watch?v=5yyB06HvAjI

Yeah, that’s an incredibly short timeframe, done on a Friday with what looks like an 8-hour time difference.

Back before bug bounties, the industry mostly coalesced around RFPolicy[0] in terms of security notification and response timelines. Upon establishing initial contact, five business days were given for a response before public disclosure if no response was received.

To me five business days seems appropriate if you’re acting in good faith and truly interested in hearing a response. It doesn’t feel like that was the intent; it feels more like a weak attempt to use the lack of response to pile on further.

https://packetstormsecurity.com/files/23364/rfpolicy-2.0.txt...

Good IT security isn't invisible; it's there to prevent people from deploying poorly designed applications that require unfettered open outbound access to the internet. It's there to champion MFA and work with stakeholders from the start of the process to ensure security from the outset.

Mostly, it's there to identify and mitigate risks for the business. Have you considered that all your applications are considered a liability and new ones that deviate from the norm need to be dealt with on a case by case basis?

In response to your last point, Image Line has has had lifetime updates for FL Studio for over 25 years[0]. They even changed the name of the product but kept the lifetime updates in place.

https://www.image-line.com/fl-studio/lifetime-free-updates/

My next sentence is really a comment on that step.

I generally find that working incrementally alongside the teams provides better outcomes. This is not to say you can't use black-box testing or perform unscoped testing, but collaborating throughout the process gives you additional visibility that can save a lot of time, especially in large-scale and diverse environments. People generally respond in a more positive and collaborative manner as well.

I'm not a huge fan of how red teaming is generally conducted. It's sometimes necessary, but the CISA report seems to indicate that the organization wasn't responding to their requests the way they wanted, leading to a communication breakdown right from the start. The vulnerability was patched and the red team's initial compromise was contained, so they targeted them with phishing, owned their domain controllers, then maintained access for months while pivoting to partner organizations, then published a public report.

It's hard to establish constructive dialogue after that, allot of bad feelings and burnt bridges - and sometimes HR. It's tough because there's generally allot of dynamics at play, but I'm sure the impact of this testing was felt by people within the targeted org.

I wish that were the world we live in.

This is from the Snowflake breach, meaning this database was an "AI Powered Unified Data Platform." It almost feels like the erosion of our privacy is fueling the growth of allot companies.

I really hope that the boogeyman is real and all this was worth it.

Because it's kind of awesome. I think the better question is why not?

In this instance, does Boeing need to fail though? There seems to be quite a bit of criminality happening, which is a law enforcement issue. The rest should have been caught by regulatory bodies.

If you get rid of the criminals and enforce regulations that ensure quality control and safety, I don't see why you need to completely eliminate the company and destroy all the supply chains they're a part of and jobs they provide.

For me I use the Will Smith video[0] from just over a year ago. Compared to the examples it's a pretty stark difference.

https://arstechnica.com/information-technology/2023/03/yes-v...

I feel bad for teenage engineering. I'm a fan of their gear and its design, including the R1's physical design. It's a shame that it didn't have utility and turned into such a hot mess.

Maybe they can add some MIDI ports and make some sort of funky pocket instrument.

Totally, the gold/blue dress picture is a perfect example of that[0].

I think with aphantasia, what makes it so interesting to me is just how much I consider visualizing in my mind to be core to how I think and understand things as well. It's not as subtle or isolated as a reaction to external stimuli but more fundamental to who I am along sitting along side my inner monologue.

[0] https://slate.com/technology/2017/04/heres-why-people-saw-th...

I learned about Aphantasia about eight months ago, and it really sent me for a trip. I have no problems visualizing in my mind and sometimes can get lost in it, to me that’s what daydreaming is.

I discussed it with some of my friends, and it seems to exist on a spectrum. The most different from me was one friend who had to really focus to visualize in his mind, and even then he could only do so in black and white.

I find it absolutely fascinating that the human experience can vary so greatly at such a fundamental level, yet it doesn't manifest in ways that are obvious to others, and everyone thinks that their form of thinking is a common shared experience so they don't even bother to talk about it.

I didn't intend for there to be contradictions (it's early, and I was on my first cup of coffee). What I meant was that the privacy battle against power has either already been decided or it never truly existed. We are granted rights by those in power, and these rights can also be rescinded by them, it's at the heart of the matter. At most, privacy is an annoyance to them because their authority is derived from their monopoly on violence.

If I hide my finances to evade taxes, it's a crime, and there are consequences if I get caught. If crypto becomes an issue, they can just make it illegal like in China. We've also had the ability to perform tax evasion using cash for quite some time.

I think the title is backward — the article discusses power as a threat to privacy and encryption, which is often the case. If everyone had perfect privacy from those in power, the tax system would be entirely based on honor, and no one would have government-issued IDs. Encryption does not significantly impact metadata collection, and its use could be a signal (no pun intended); and a single warrant can revoke a fair amount of the privacy that has been granted.

I believe that an educated population poses a greater threat to "power" more than anything else. If more people understood what encryption is and how it affects the integrity and confidentiality of communication(and understood what those terms mean) and why privacy is important, we would be having a much more constructive discussion or at least adopting a more united adversarial stance against attacks on these technologies and rights, similar to the 90s when the online population was generally more technical and concerned about these issues as a whole.

More than anything, attacks on encryption and privacy should be seen as attacks against the social contract we have with those in power, and they're failing to provide adequate justification for the mass erosion of privacy.

There's no panic; people just aren't accepting the lack of security and privacy being presented.

If this is tame compared to a few years from now, then the path we travel to get there will be lined with these types of implementations. Now is the time to push back before it gets to that point.

As for the freaky stuff I do: talking to friends, family, coworkers, banking and financial transactions. I don't use it, but online healthcare is becoming more and more prevalent. I search for things that are of interest and impact to me and my family.

For SSID's the one thing I would recommend is appending "_nomap" onto the name to opt-out of location service databases from Google, Microsoft and Apple.

That's a bit of a unfair comparison.

In the context I was discussing I consider it a pragmatic take because our response to these issues needs to be understood across multiple domains including privacy.

That's not to say that nothing should be done. Personally, I'd like to see measured legislation placing more security, privacy and liability onto manufacturers and providers.

Doing some more digging, this is where the data is sourced

"Hudson Rock acquires and purchases compromised data directly from top-tier threat actors operating in closed circle hacking groups. What sets our data apart is its quality in providing high accessibility to hacker groups looking for potential targets, and the speed in which we make it available to clients compared to other threat intelligence companies. Our operational knowhow, and our boots-on-the-ground approach to cybercrime originates from the IDF's 8200 Cybercrime division, and its efforts to thwart nation-state adversaries and professional threat actors."

https://cavalier.hudsonrock.com/docs

This would imply that they are financially engaging with and supporting cyber criminals.

This is the description of one of Hudson Rock's main products, "Bayonet".

"Imagine getting access to a lead-generation platform featuring hundreds of thousands of compromised companies around the world with active vulnerabilities that you can convert into customers."

I've seen and dealt with a couple of these types of companies. It's a pretty sleazy tactic, and it's low skill/effort from a technical point of view as well.

The true cost of any of this is very hard to quantify. There are reputational costs (though you generally want to buy the dip after a hack), national security concerns, intellectual property theft, etc. So, it is a weak argument in that regard, but that's only because there's not a lot of good data to even form a solid opinion on. Sorry if my comment seemed a bit ambiguous.

Personally, I have seen during incident response many organizations drop seven figures on EDR, IDS/IPS, and a bunch of widgets while ignoring or refusing to do simple things like network segmentation and configuration/patch management, and it's because they've been sold silver bullets by their vendors, so I also hold a bit of contempt for the industry as well.

I've worked on several high-profile botnet takedowns that have resulted in arrests. There is a very fine line and a slippery slope that you absolutely need to stay on the right side of, or things can become very invasive and unethical[0].

Online scams, fraud, and malware have been around since the '80s, and we've survived.

Additionally, a huge industry has been built around it, employing many people and generating massive amounts of wealth compared to the direct costs of these activities. Just compare the cost of ransomware to the "cost of cybercrime"[1][2] which is mostly revenue for the cybersecurity industry, and there is a magnitude of difference.

[0] https://www.vice.com/en/article/qj454d/private-intelligence-...

[1] https://www.bleepingcomputer.com/news/security/ransomware-pa...

[2] https://www.weforum.org/agenda/2024/01/cybersecurity-cybercr...

I think of them like this: Authentication is the act of verifying that you are who you say you are, generally with something you know (password) and ideally with something you have (token, authenticator app, etc.). This lets you log in.

Once you log in, you are granted authorization for certain tasks. This could be rights to an individual record or column, or it could be administrative privileges within an app. It's not involved in determining who you say you are; it authorizes you to access things based on who you are (from the act of authenticating).

That's the way I understand those two terms and their practical applications.

The water supply of the Nile is no longer as stable as it has historically been. Ethiopia's new dam threatens the downstream supply for Egypt and Sudan.

https://www.bbc.com/news/world-africa-57734885

It's one-quarter of their collection, and they've had 271 years to accumulate and catalog all this material. As others have mentioned, they have enough staff.

I would assume they issue a receipt and itemize donations nowadays. I think part of it could be reluctance because not everything they have in their possession is rightfully theirs[0].

I don't know all the attributes required to properly catalog an artifact, but I imagine that advances in computer vision and translation could help tremendously.

https://www.businessinsider.com/british-empire-stole-cultura...

Not necessarily. I always try to write to disk first, usually in a rotating compressed format if possible. Then, based on something like a queue, cron, or inotify, other tasks occur, such as processing and database logging. You still end up at the same place, and this approach works really well with tools like jq when the raw data is in jsonl format.

The only time this becomes an issue is when the data needs to be processed as close to real-time as possible. In those instances, I still tend to log the raw data to disk in another thread.