Live data from Hacker News

Incident Report: CVE-2024-YIKES

nesbitt.io

51–60 of 187 posts

Re: Incident Report: CVE-2024-YIKES

#51
post #36

Earlier quoted context omitted.

In any case, not really a hacker's creed. This has always been withinin the realm of corporations, especially Silicon Valley or adjacent.

MFABT is about survival. Don't hate the player, hate the game.

Don't know any hackers who talk like this. More "if you don't like the rules, play a different game"

Re: Incident Report: CVE-2024-YIKES

#53
the Karen one gave me a good laugh :D ;) reminds me of a `make`-based build script I once got when reviewing a classmate's project - it attempted to `rm -rf` my home folder if the hostname contains `bpavuk`. that was in seventh grade!!

Re: Incident Report: CVE-2024-YIKES

#54
post #36

Earlier quoted context omitted.

In any case, not really a hacker's creed. This has always been withinin the realm of corporations, especially Silicon Valley or adjacent.

MFABT is about survival. Don't hate the player, hate the game.

I will absolutely hate the players that chose the game and designed the rules.

Re: Incident Report: CVE-2024-YIKES

#55

The maintainer of left-justify receives his YubiKey from yubikey-official-store.net. It is a $4 USB drive containing a README that says “lol.” Got me seriously laughing... Such a troll.

Yeah that's great. I love that plugging in the USB device from the phishing site is, itself, another attack vector...

Re: Incident Report: CVE-2024-YIKES

#57

Earlier quoted context omitted.

Move high value crates into the standard library?

Maybe give crates a gold star if they have no external dependencies?

That's not at all a bad idea, imo. And a silver star for crates which only depend on gold star crates...

Re: Incident Report: CVE-2024-YIKES

#59
post #35
post #11

Customers give us heat for not shipping the latest vulpine-lz4. Their AI-based heuristic antivirus total defence solution automatically flags all software not running latest versions of everything Kindly advice

Ya, latest is a mess. I don't care about latest, I want the version with no known security flaws.

I almost prefer the one with the known security flaws that I can mitigate.

Re: Incident Report: CVE-2024-YIKES

#60
post #2

Supply chain incidents suck and we need to do better. Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.

A ton of the most popular crates on crates.io are already first-party crates provided by the Rust organization itself. This is often overlooked when people are wringing their hands about Rust crate graphs. Looking at the top 10 list of most-downloaded crates on the front page of crates.io, the only one not either from the Rust organization or from a Rust core maintainer is the base64 crate.
Post reply on HN