81–90 of 291 posts
Earlier quoted context omitted.
> seems like there's no solution There is - don't depend on anybody else's software. It just means that software development will take longer and cost more.
This assumes that your own software is more secure.
Does anyone know if log4net the .net version of log4j is effected?
Hey, English is not my first language. Is "effected" here the right word to use or would "affected" be the correct term? I see English speaking people use these two interchangeably so much online that I am starting to doubt what I learned in my English courses.
Does anyone know if log4net the .net version of log4j is effected?
Hey, English is not my first language. Is "effected" here the right word to use or would "affected" be the correct term? I see English speaking people use these two interchangeably so much online that I am starting to doubt what I learned in my English courses.
If you automatically update your dependencies all the time, you will constantly get new bugs, issues and sometimes even malware. If you don't update your dependencies all the time, you will be vulnerable to old bugs and issues. The current software engineering paradigm has no meaningful answer to this , no matter what "security experts" tell you. In a sane industry this realization would lead to a change of the parad…
Earlier quoted context omitted.
So somehow false positives negate all the actual positives caught and corrected? The only true solution is what? Manual audit of everything by some perfect human security practitioner? I suppose the same applies to automated development tools then. I will concede there probably are some firms out there acting poorly that way. When aren't there? Humans sigh . But by in large automation and the problems inherent are re…
The problem isn't that audits are inherently worthless, it's that most of these tools are very low-quality implementations of the concept. In one of my past jobs I was an early-mover on doing a lot of our ops on Linux and the audit tools had no concept of the backport security model whatsoever. If you were running on some kind of LTS distro rather than a current distro, it would see "gosh you're 3 minor versions behi…
I think the problem is that the current audits are inherently worthless. I've never seen another industry that would accept a 95% false positive rate from a tool. But that's on the low end from my experiences (I've done 4 major codebase audits, and worked in the security industry for 5 years)
Tools that routinely spit out 1000 plus vulnerabilities, and 6 months later you've checked off all of them without a single valid vulnerability in the list (but 3 you found yourself during that time that were missed entirely by the shitty regex that is really the entire tool in question).
Does anyone know if log4net the .net version of log4j is effected?
Hey, English is not my first language. Is "effected" here the right word to use or would "affected" be the correct term? I see English speaking people use these two interchangeably so much online that I am starting to doubt what I learned in my English courses.
I never understood where log4j 2 was supposed to fit in the ecosystem. * We had log4j 1, which was good enough for most use cases and everywhere. * We had slf4j/logback, which was from the same authors, and broke backward compatibility but gave us a fundamentally better design. * We had java.util.logging, which while braindead was builtin to Java and hence available everywhere. *We had commons logging, which was neve…
Does anyone know if log4net the .net version of log4j is effected?
Hey, English is not my first language. Is "effected" here the right word to use or would "affected" be the correct term? I see English speaking people use these two interchangeably so much online that I am starting to doubt what I learned in my English courses.
Even with English as my first language, and as a life-long pedant, I still have to stop and think each time I use one or the other.
Does anyone know if log4net the .net version of log4j is effected?
Hey, English is not my first language. Is "effected" here the right word to use or would "affected" be the correct term? I see English speaking people use these two interchangeably so much online that I am starting to doubt what I learned in my English courses.