11–20 of 85 posts
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?
> We have established a JCDC senior leadership group to coordinate collective action and ensure shared visibility into both the prevalence of this vulnerability and threat activity
Very clearly they know what they will be doing.
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?
do I need to worry about this as a frontend web developer?
If there’s no java, then there’s no log4j and you may worry about other issues.
Not only "user facing" systems. Not even a WAF can protect these.
do I need to worry about this as a frontend web developer?
Do you have any java in your application stack (i.e. elastic search)? If there’s no java, then there’s no log4j and you may worry about other issues.
Someone should tell them that any system that it logging user supplied data can be affected. Not only "user facing" systems. Not even a WAF can protect these.
Yes, some attacks could still get through (e.g. a backend that receives requests base64-encoded), but that's the case generally with WAFs I think.
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?
This type of a call would likely be focused on assessing current state at that point.
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?
Security vulnerabilities aren’t exploited on weekends out of courtesy
Someone should tell them that any system that it logging user supplied data can be affected. Not only "user facing" systems. Not even a WAF can protect these.
If the WAF blocks any request containing "{", that would be fairly safe, right? Yes, some attacks could still get through (e.g. a backend that receives requests base64-encoded), but that's the case generally with WAFs I think.
“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?
Security vulnerabilities aren’t exploited on weekends out of courtesy