171–180 of 246 posts
Earlier quoted context omitted.
Use one of these: http://www.wnd.com/files/2015/08/hillary-clinton-secret-serv...
"You mean like, with a cloth or something?"
Earlier quoted context omitted.
The guy that couldn't "reverse a binary tree" came from a team that turned out to be incompetent (in operations field; they didn't see anything wrong with distributing all the packages with software using HTTP without SSL/TLS nor any cryptographic signature).
Are we talking about Homebrew guy? Was this a flaw in Homebrew or something else he worked on?
Earlier quoted context omitted.
It looks like the [flagged] label was incorrectly displayed—users haven't flagged it.
Strangest thing I've seen on HN in a while. Anyways, it's gone now.
Enable two factor authentication on your servers, or else two factor on a bastion server and disable external ssh other than from your bastions on all other servers. I strongly recommend YubiKey, it is convenient and cheap and extremely secure. With ssh it is very easy for someone to create an ssh key that does not have a passphrase. With that, it is possible to log into the server with just the key file and nothing…
Installing fail2ban is also a very basic / smart way to discourage brute force SSH attacks on your boxes. Also you could try piping your SSH logs into something like papertrail / slack, so you have clear visibility into who's logging into your servers, etc.
Earlier quoted context omitted.
If you're going to offer a reward, I suggest making it conditional on revealing how they got in. (This also assumes you're able to contact the person who sent the e-mail.)
> making it conditional on revealing how they got in Do you mean obligatory ? If you really mean conditional, could you elaborate why?
In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
Unfortunately, it's the later - no details of exploit, just a proof. If this comes to ransom, rather than unethical/unexperienced gray hat thing, are there any good steps to take? Or hiring an expert consultancy is probably the only good option here?
I'm not saying you should or shouldn't, but several comments have suggested contacting this person; it's not clear that that's even possible.