Viewing profile — christophetd

The malicious commit (2cd2223dcd90fa9d9c72851427602aa0e179e061) was not signed. Sorry you feel like the writing isn't frank.

If the maintainer themselves added the backdoor, can't they be considered a malicious actor?

Yes, that would be caching. We kept the first sentence, as it's still possible his account was compromised (we have no strong evidence to prove it, but no strong evidence to refute…

Thanks for the heads-up, the goal was mostly avoiding that typing the author's name in Google brings up this post. I'll have it blurred for the sake of consistency, though.

We just updated the wording. Thanks for the feedback.

One of the authors of the post here. We prefer sticking to the facts rather than speculating the account was compromised without having a solid proof. Someone on /r/netsec also had…

Hello! One of the authors of the post here. Just added a sentence in the introduction to make it crystal clear: > While FastAPI itself is not impacted, this is an interesting occur…

Hello there! I'm one of the authors of the post. Sorry you feel we "hyped it up", that was definitely not the intent. The malicious package is targeting FastAPI applications. The p…

Author here - have a look at the methodology section at the bottom of the page. Feel free to ask if anything is unclear.

Author here - sorry you feel like this is content marketing. I identify myself as a cloud security engineer, so that's a clear antigoal. The intent is to show what's the systematic…

Sure. My point is that Trusted Advisor is also a commercial product, as opposed to IAM Access Analyzer which is free.

One of the authors here - confirming that "40 percent of organizations have at least one IAM user that has AWS Console access and does not have multi-factor authentication" is abou…

Hello! One of the authors here. We did release some (hopefully) actionable guidance alongside the study[1]. Trusted Advisor is a fair point, but note that most of its security chec…