ukigumo

I quite enjoyed the "Tin Drum" but I admit that I lost a bit of respect for the man when it was revealed he had worked for the Stasi.

Still, it is a great loss of a great writer.

Unless you can make the case that risking commercial relations with the current largest economy in the world over these attacks makes sense... I would say never.

hey man, don't say anything negative about the G. It goes on your permanent record!

/s

edit: apparently sarcasm does not go unpunished. ah well.

This is what I mean with knowing what risks your application / framework / language will bring and mitigating them accordingly.

(edited for clarity)

The part that shocks me the most about this attack is the userbalances table. What a terrible decision to give up on securing the integrity of your most important data in the name of performance.

I don't completely agree with you here.

My experience has been 80% + in Solaris and OVM for SPARC (also some AIX with LPARs) and I am not aware of any exploit that breaks the non-global zone security boundary to the control domains or other NGZs. I'm fairly sure I haven't seen any in FreeBSD either but I could be wrong here.

In Linux, I am aware of privilege escalation exploits involving symlinks and complied objects (out of the top of my head, might be old or inaccurate) but overall the thinking goes that having a compiler available opens up a few extra attack vectors while not having it installed doesn't break anything at all.

I published an entry level article on building a gold image with ubuntu where I try to map some best practices and my experiences here: https://blog.ukigumo.eu/anatomy-of-a-gold-image/ I never got around to publish the rest of the series but still plan to, so feedback is welcomed. Maybe I should point out that I'm not exactly a sysadmin though :-)

Regarding L7 firewalls, I have recommend that they are installed and _used_ in all environments I've worked in (banks, insurance companies, payment services providers, stock exchanges, etc) and I do agree with you that often the feeling is that if they are installed and set to defaults it's good enough which is worrying but that's not to say that they should be abandoned.

Security is all about risk mitigation and all we can do is not to make it too easy for our platforms to be broken into and data to be lost, and I think if you dismiss obscurity you might need to try out something like setting up a couple of honeypots with commonly used services in your network (one with default ports one without for instance) and keep some notes of your experience :-)

I'm not sure what you mean, so my answer below might be a misfire in which case I apologize.

If an attacker can get a shell they would still need to have access to a exec environment and / or breakout of a "jail" or other protected space. Protecting your data store can prove tricky but there are quite a few products and techniques that basically reduce the amount of data that can be breached by any one attack vector (database firewalling, query filtering, etc).

Tidying up an OS + middleware (and having a decent L7 firewall) is sufficient to deter most attacks which is all you can hope for unless you can afford a good security architect and a response team and even that does not guarantee 100% security.

Obscurity, by itself, is not a solution but is often one of the most effective tools to deter simple attacks.

My point exactly. If instead of wordpress they had a copy of some other big-old-java-thingie it would have been just as exploitable.

I disagree. Having poor security "hygiene" is dangerous, the tools that you select to shoot yourself in the foot are less important than having a hardened server with minimal services and installed software (and host intrusion detection, etc..)

I would say it is easier to shoot yourself in the foot with C than with Java or other managed runtimes.

PHP code can be as secure as anything else, in my experience, but the end state solution has to take into account the possible risks and mitigate them accordingly.

Putting it in another way, would you say it's more dangerous to have a DB and java appserver running on the same "server" or having a PHP application in one box in one network segment and a DB server in another box, different network segment and with different privileged credentials?

It may come as a surprise to many, but on high security services such as banks, servers that handle critical data cannot have any build tools installed or usable.

Having said this, I've found limited proof that a particular language is any safer than another as it comes down to safe coding policies and risk mitigation strategies.

Are you saying the service by itself is responsible for an increase in the utilization rate for a class of transportation (ie, the car)?

If that's the case, then did people stop ridding bikes? Taking the bus? Or did (many) people start using uber instead of other taxi companies because of the price difference (due to uber not paying for all the licenses and insurances other transport companies are subjected to)?

If the later is the case, then regulation exists to discourage unfair competition.

I'm no expert in neurology or any related field but I think the concept on consciousness is somewhat fuild but overall I would explain it like this:

Knowledge of self, aknowledging one's physical and mental limitations and one's ability to relate and interact with others and the environment in such a way that transcends on's initial limits if one is so inclined(ie, desire for growth and the choice not to do it).

Just responding to stimuli is not enough, because humans can accept that the stimuli and chose not to respond to it or can decide to act despite said inputs.

You make a good point but I think in OSS projects merit is the only product being sold so meritocracy works. In a for profit organisation, you would always need a management layer because the focus should always be the product and not the individual contributors.

You reminded me of a story of a good fried on mine that kept getting "randomly" picked for extra screening every time he would go into the US. The fact that he's built like a rugby player and very clearly middle eastern probably helped.

One day, fairly fed up with the long journey and yet another selection he went "Relax guys, I'm only here because I write the software the you guys (TSA) use".

Moral of the story, if you are good enough, there's always a place for you.

Fair enough, you have a point there because I skipped the "almost" from your previous comment somehow.

Very nice write-up.

>Rewriting a monolithic platform as a set of microservices will almost always result in improvements from every perspective

That is one dangerous assumption you made there mr. Performance (in terms of response times, IO waits, etc) can be severely affected in distributed designs.

https://kolabsystems.com/ is really good and you get a full groupware solution.

Or run your own kolab server in an AWS instance for instance. :-)

Not sure which part of the UK you are talking about, certainly not London and the City in particular.

Ok you got me there. :-)

I just think that this is a company with no product, no business model, horrendous business practices and somehow their valuation is still higher than the entire market they operate in. At least their not selling the data to the IRS, right?

I think I'll be reading that book soon because it deals with very much what I'm trying to do on a daily basis, except that I don't believe DevOps by itself is the magic bullet, instead a mix of the best practices from both the dev community and the enterprise world are what can make IT companies successful without the drama and the waste.

Is this what a 40 billion dollar startup looks like?

I prefer that the initial interviews be about knowing what the candidate wants out of the job he's applying for, how it fits into his master plan etc. Then I want to try and figure out if I really want to spend a third of my waking life working with this person. Only towards the end of the process, and only if I'm not too sure about the candidate ability to do his job (eg: did not demonstrate interest in keeping himself up to date; was not able to articulate how X adds value over Y; etc) will I go into full-on technical interview.

Sounds weird right? But the thing is, I'm not hiring rocket scientists so I don't need the best of the best, just someone who knows his stuff and isn't afraid of saying "I don't know (but I will find out)" when that's the case. I also take great care in planning work and defining deliverables so as to reduce the pressure on my colleagues' workday and there is hardly ever a situation where we need to rush to meet a deadline. If or when that does happen, I find that the culture of trust and a certain amount of friendship does wonders for the team's spirit.

Assuming you have access to your mail server to make the necessary configurations, wouldn't something like ciphermail's (https://www.ciphermail.com/) pgp /smime gateway make it easy for joe user to have encrypted email?

I've used it in my own setup and think it works quite nicely so far but then again I only have 8 people using it.

Ok. The reason I was asking is that it depends on what scratch you will itching (eh, I'm funny).

Generally speaking, think of it this way: I can buy from multiple vendors, some of which show up in some magic quadrant report which my CTO reads. Why would I pick your product instead?

The usual good reasons are that you can provide me with professional services to do the integration, educate users, participate in project delivery, etc, but essentially that you are able to somehow remove some degree of risk for me and the company. You will most likely need to show some evidence of compliance to best practices for security, data privacy and segregation.... well depends on what you product does and what company you are selling to, for sure, but think of the PCI and Data Protection Act's guidelines at a bare minimum even if not directly applicable.

Specifically around support, I will want to know what are your SLAs including MTTR, MTBF and availability to begin with, and then I expect you to sell me 2 or 3 support coverage contracts (bronze, silver, gold) and offer me a possibility to design my own (platinum) if I need better. See Google's GCE page for instance: https://cloud.google.com/support/

Hope this helps you somewhat, but without knowing more it will be hard for me to get into any more detail.

What are you selling?

I'm on the same boat. When people know my salary they think I'm rich, but the truth is that I can't save much more than I did when I was living in Holland making ~40% less.

Now I have a baby and the wife can't really have a career because a nursery would cost more than she can reasonably expect to make as a designer at this stage.

Relevant BBC documentary: https://www.youtube.com/watch?v=t2BiuW93bos

What would it take to create a a public transparency database mapping real estate investments to tax evasion tactics?

There's always a rift between what one means for other people to understand and what they actually do. Case in point, I thought I had made a clear statement that I thought your post was disingenuous and immature and did you a disservice by casting you as more of a coder than a valuable engineer.

I'm not saying I'm right and you are wrong, I just made a reflection of how you came across. Was that clearer now?

As for my points being non-sequiturs, I'll admit that I fail to see _any_ point in your post other than you don't know what a product manager _is_ and you feel attacked somehow, so there's a fair chance you are right.