Finally ! Now send me the.megadownload-link for Bigfoot and e.t photos
NASA Has Been Hacked
61–70 of 114 posts
Re: NASA Has Been Hacked
#62IT security people need to stop thinking in terms of disallowing “unauthorized” devices on physical (wired and WiFi) and recognize start designing for human nature. Assume that the physical networks are compromised, and have all privileged resources only accept connections over VPN. Is it perfect? No, but it makes further compromise harder. The assumption of no trust also means acknowledging that you need gate incomi…
Meanwhile DNS, which is a precursor to almost every connection ever, is rarely encrypted or authenticated in practice. Standards like DNSSEC and DNS over TLS exist but seem to have lots of vocal opposition without any serious proposals for improvement. A Microsoft certificate training I took recently literally put emphasis on randomizing source port numbers as a way to mitigate attacks.... let that sink in.
Perhaps tls v1.3 will help? I've read cloudflare is doing major work to find dns solutions in conjunction with Mozilla encrypting sni, configuration for dnssec and so on.
https://blog.cloudflare.com/encrypted-sni
https://blog.cloudflare.com/encrypt-that-sni-firefox-edition
Re: NASA Has Been Hacked
#63For further context, here’s another report on NASA’s security in 2012. https://oig.nasa.gov/congressional/FINAL_written_statement_f... Sadly, it doesn’t seem like things have changed.
Note that the report in the OP is a report on JPL, not NASA. JPL is a federally funded research institution that does most of its work for NASA, but it is run by Caltech, not NASA directly. Having seen the process from the inside, I can attest that NASA's security posture has changed enormously over the last 5 years. If anything, we've swung the pendulum so far in the direction of security that measures are being put in place that interfere with our work for little to no real security benefit.
Re: NASA Has Been Hacked
#64Don't forget, CBP likely already compromised their security before.
https://www.theatlantic.com/technology/archive/2017/02/a-nas...
Re: NASA Has Been Hacked
#65Earlier quoted context omitted.
Why do you think it's not true?
Starting from Hanlon's razor, you assume incompetence is likelier than malice. Saving the "do not track" preference as a cookie is the most obvious way to distinguish new visitors with no cookie from users who have opted-out, but this means issuing a request to each and every ad network to store a cookie with them. Indeed, a quick look at Chrome's network tab reveals that they are, indeed, making a bazillion requests…
I apply Hanlon's razor to individuals, not collective entities such as a company or agency. The behavior in recent history of such entities I think warrants the exception to the rule.
Re: NASA Has Been Hacked
#66Earlier quoted context omitted.
Unfortunately there already is. When I interviewed for a job in Antarctica we had discussed methods of saving on bandwidth usage and I suggested the use of a PiHole to strip out ads to save precious KB and was told that the Raspberry Pi was frowned upon due to previous issues, and it would likely never happen. :(
Good news then: you don’t need an actual Raspberry Pi or to run “pihole” software in order to filter ads via DNS. Just a beige Linux box running dnsmasq is enough!
I mean, it's just a DNS server right? There are probably watches that could run it.
Re: NASA Has Been Hacked
#67Earlier quoted context omitted.
Starting from Hanlon's razor, you assume incompetence is likelier than malice. Saving the "do not track" preference as a cookie is the most obvious way to distinguish new visitors with no cookie from users who have opted-out, but this means issuing a request to each and every ad network to store a cookie with them. Indeed, a quick look at Chrome's network tab reveals that they are, indeed, making a bazillion requests…
I apply Hanlon's razor to individuals, not collective entities such as a company or agency. The behavior in recent history of such entities I think warrants the exception to the rule.
It’s a heuristic that gives you a good starting point, not some sort of law. As it stands, it’s a starting point that’s easy to back with data suggesting it is indeed the case. If you can point me towards evidence that malice is indeed the case here, I’ll willingly change my mind.
Re: NASA Has Been Hacked
#68Earlier quoted context omitted.
Unfortunately there already is. When I interviewed for a job in Antarctica we had discussed methods of saving on bandwidth usage and I suggested the use of a PiHole to strip out ads to save precious KB and was told that the Raspberry Pi was frowned upon due to previous issues, and it would likely never happen. :(
Then just use a server that does the same thing. If the issue is the buzzword then work around the buzzword.
Oh of course, software is software, I just mean when a Raspberry Pi was mentioned that it has a distinct stigma.
Re: NASA Has Been Hacked
#69I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There were several problems: the inventory tracking issue was particularly enlightening: >system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators respon…
Back in the early 90s I had a summer internship for a contractor at Goddard Space Flight Center. My job for the entire summer was to track down and inventory a list of 1000s of devices across the entire campus. At the time they were building a tracking database for all the devices on the campus. The printout I was handed on my first day had not been updated in several years. It basically contained a tracking ID, what…
Im having flashbacks to when i had a similar job at IBM back in the day, and we "lost" a z990 system. There was considerable more understanding when I couldn't find a blade server the size of a hardback book than when i couldn't find a machine the size of a car. Thankfully it showed up in Beaverton like 3 months later.
Im still bitter about their ITCS 300 policies that dictated I couldn't have access to the LOM of the blades to enable the beacon light for identification. Nothing like walking through multiple 8,000 sft server rooms looking for 1 server among thousands.
Re: NASA Has Been Hacked
#70Earlier quoted context omitted.
If accepting is a no-op then you are being tracked even before you make your decision - as the page already have been loaded. A brutal violation of course but I absolutely expect that to be the case.
Perhaps the purpose of the spinner is to delete the data they've already collected? Are you still being "tracked" if all copies of the data are destroyed?
Maybe, but hardly GDPR compliant.
Not that they are aiming for that. God knows what they are attempting.