michiel3

It actually looks like the company was OK with it. The disclosure timeline shows they were responsive and addressed the problem quickly when they were made aware of its existence.

That is correct. The reporter requested public disclosure after the report was closed. The bug automatically gets disclosed publicly 30 days after the report is closed, unless the team requests more time by re-opening the bug. You can read more about the disclosure philosophy here: https://hackerone.com/guidelines

"Introducing a bounty program for the most secure open source project on the planet, 0 CVEs in its 30+ year history! http://hackerone.com/msdos" - https://twitter.com/Hacker0x01/status/450787521497034753

Relevant blog post by Yahoo! from earlier this month:

http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the...

In the post he also describes that he now uses a new process which involves a computer that has never been connected to the internet and its sole purpose is encrypting and decrypting files. Why not use it to encrypt and decrypt emails as well? That'd also potentially involve generating a new key pair.

> 3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA – so it probably isn't. If you have something really important, use an air gap. Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good.

Why do you think 2GB free is no-where near enough? I know a lot of users that use Dropbox's free plan and are happily syncing and sharing.

I use 7% of my 12 GB.

Remove all friends sounds malicious to me. Must say that I haven't tried the app myself.

For users with a Retina MBP: this version of Sublime Text supports Retina graphics on OS X Lion.

Yep, if you're blocking remote hosts to authenticate on 3306 (or any other port you're running mysqld on) you're safe. The attacking host can't authenticate itself, so it's unable to exploit this bug.

There's not much on this topic yet. @securityerrata started tweeting about it and trying to find out more: https://twitter.com/securityerrata/status/210550374627676160. Could be a hoax, or VUPEN keeps it quiet. We'll probably never know.

If you're going to use a password manager, I would recommend 1Password or LastPass.

Other tricks you can apply:

- Use a different password on every website. To help you remember it, you can choose one main password and make variations on it for every website (the variation is based on that website, but don't make it too obvious!)

- I can't tell my password for a specific website if someone points a gun at my head, since I don't know it. I need a QWERTY keyboard to enter my password, because I only remember the flow of the characters I type. I don't remember all the characters.

This is probably a best practice you could learn yourself to implement every time you know for sure you don't want a GET/POST variable to be a hash/array. This can also prevent other application errors when someone passes a hash/array which is used somewhere in the code where it is expected to be a string or something.

This won't help that much, because this means you can only visit the website with some authentication string, otherwise the browser will prompt for your credentials.

This technique is widely abused by phishers. Most browsers detect such phishing attacks and warn the user for it (see example in Safari 5).

Firefox might do a better job on this subject: it performs a HEAD request first, to see if the website actually requires authentication. If not, the user receives a warning to make the user aware of a potential phishing attack they might have been trapped into.

I've many seen organizations applying spam filtering on their security@org.org address, leading to tons of reports ending up in spam boxes without being noticed by the company. The researcher doesn't receive any feedback on his responsible disclosure and multiple reminders, and finally submits the vulnerability to a full disclosure list.

Well, currently the malware itself is not detected. OK, some anti-virus solutions detect the piece of malware as suspicious or as a packed executable (which is suspicious of course). But those detections are just based on the inner working of the executable or how it behaves. It's not being detected by anti-virus definitions, that will be a matter of time before anti-virus providers will add definitions for this piece of malware.

Have a look at the movie that's embedded in the blog post. He's explaining which piece of malware is downloaded.

The attackers were focussing on client workstations to infect with malware, that's where the big money is. Potentially they could have owned some mysql installs by replacing installer binaries but it's less interesting for banking fraud etc.

MySQL.com was successfully attacked earlier this year: http://developers.slashdot.org/story/11/03/27/2058246/mysqlc...

And they denounced trust in all certificates that are issued by DigiNotar and currently migrating to new CAs (Getronics). The digital identity portal DigiD for government services is already migrated to Getronics CA.