Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosec company pwned by 4chan user

maia.crimew.gay

Post reply on HN
Print view View original

181–190 of 234 posts

Re: Infosec company pwned by 4chan user

#181

Post by von_lohengramm »

status200 wrote: post #79
brodouevencode wrote: post #49

Earlier quoted context omitted.

Appears to be self-authored.

Easy to check on wikipedia, looks like it was created by the user Ezlev [0], who does not appear to be crimew's wikipedia acocunt, and updated by several other users over the last couple years. [0] https://en.wikipedia.org/wiki/User:Ezlev

Because this literal fugitive hacktivist is clearly incapable of finding creative ways to get diversified contributions to their Wikipedia page. Heck, they even proudly link to their WP page from their personal site. If they didn't write the article themself, then it was most likely a friend who's close enough to write something that screams self-authored page. Like c'mon, just look at the thing. Have you ever seen that many citations on something that isn't just spamming them trying to stave off the Wikipedia police?

Re: Infosec company pwned by 4chan user

#182

Post by lmm »

sidlls wrote: post #23
code_runner wrote: post #20

Earlier quoted context omitted.

jenkins is old and crusty, but it works and works well. if the UI for a build tool looks too fancy, my faith in it drops to 0 almost immediately.

It doesn’t work well. It’s the JIRA of CI/CD: it is entrenched and does multiple things but doesn’t do any one thing well, and the people that decide what to buy aren’t the people who are forced to use it so they don’t care about its quality so much

Jenkins is what I want to use, because for all its clunkiness it has a better deep integration with my actual build tools than any other CI tool I've ever seen. It's a pain for the admin but it's great for the user, so if anything it's the opposite of JIRA.

Re: Infosec company pwned by 4chan user

#183

Post by lmm »

sofixa wrote: post #5
philipwhiuk wrote: post #3

Who makes their Jenkins instance world accessible!

Who still uses Jenkins? It's an abomination of an obsolete system that is just a pain to use, manage, maintain, setup, etc. while there are much better, more featured, easier to use and maintain alternatives out there. And it has been like this for close to ten years now . It should have been ripped out in favour of either the "native" CI/CD (e.g. GitLab CI if GitLab is used for VCS, GitHub Actions if GitHub, etc.) o…

Jenkins is still inherently more full-featured than anything that just runs random docker images and commands. Any replacement would need to do the hard work of actually integrating with a bunch of different language build tools in a deep way, and so far no-one's stepped up.

Re: Infosec company pwned by 4chan user

#184

Post by paulddraper »

JackSlateur wrote: post #146
deng wrote: post #137

Earlier quoted context omitted.

No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.

The most comedic mistake is to have a running jenking in 2023

Highly customizable CI tool.

Re: Infosec company pwned by 4chan user

#186

Post by yjftsjthsd-h »

Izkata wrote: post #172
yjftsjthsd-h wrote: post #158

Earlier quoted context omitted.

Well sure, but ssh and make run from what?

A crontab?

I guess that works if you want your jobs to run on a schedule; I prefer push-based (you make a commit, you push it to the central copy of the repo, and it automatically triggers jobs).

Re: Infosec company pwned by 4chan user

#187

Post by ilyt »

deng wrote: post #137
dmbche wrote: post #2

"however, they made one of the most comedic mistakes you can still make while setting up jenkins (im actually not sure which misconfiguration leads to this): the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url. genius."

No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.

Public facing AND without any sensible auth.

Re: Infosec company pwned by 4chan user

#188

Post by ilyt »

bheadmaster wrote: post #123
dmbche wrote: post #2

"however, they made one of the most comedic mistakes you can still make while setting up jenkins (im actually not sure which misconfiguration leads to this): the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url. genius."

The most horrible thing Jenkins does to devs is it encourages bad practice. Good practice is so cumbersome to do properly (create a secret, load secret in env through Groovy code, setup git configuration in a shell script) that, unless someone is actively monitoring them, devs are always in a temptation to just put the credentials in the git URL, we'll remove them after testing . Then one out of N times they forget a…

Uh, no, you just pick credentials from list in the repo config.

If you wanted to download additional repo in the jenkins script sure, but Jenkins Git plugin just accepts credential (whether its password or pub/priv key pair), just paste URL and select one from the list

Re: Infosec company pwned by 4chan user

#189

Post by ilyt »

sofixa wrote: post #5
philipwhiuk wrote: post #3

Who makes their Jenkins instance world accessible!

Who still uses Jenkins? It's an abomination of an obsolete system that is just a pain to use, manage, maintain, setup, etc. while there are much better, more featured, easier to use and maintain alternatives out there. And it has been like this for close to ten years now . It should have been ripped out in favour of either the "native" CI/CD (e.g. GitLab CI if GitLab is used for VCS, GitHub Actions if GitHub, etc.) o…

Builtin code coverage and test display (not just "your build failed") is still not a thing in Gitlab/Github CI

And that's like the fucking basic feature every CI/CD should have.

Re: Infosec company pwned by 4chan user

#190

Post by ilyt »

mannyv wrote: post #140
sofixa wrote: post #5

Earlier quoted context omitted.

Who still uses Jenkins? It's an abomination of an obsolete system that is just a pain to use, manage, maintain, setup, etc. while there are much better, more featured, easier to use and maintain alternatives out there. And it has been like this for close to ten years now . It should have been ripped out in favour of either the "native" CI/CD (e.g. GitLab CI if GitLab is used for VCS, GitHub Actions if GitHub, etc.) o…

Jenkins is one of those things you configure and forget about...until you need to do it again. Over time, there's so much stuff that it does that replacing it is a ton of work. And by work I mean verification and communication. Many developers have no idea how stuff gets built, or how dependencies are managed in the build system. You forget one thing and the build is toast. Hunting this info down takes a ridiculous a…

> Jenkins is one of those things you configure and forget about...until you need to do it again.

And when you do now install and most of plugins is out of date and with security bugs...

Post reply on HN