Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LogJ4 Security Inquiry – Response Required

daniel.haxx.se

Post reply on HN
Print view View original

11–20 of 128 posts

Re: LogJ4 Security Inquiry – Response Required

#11

Post by evan_ »

kube-system wrote: post #8
BiteCode_dev wrote: post #6

It's actually fantastic to receive such email. You can answer: "We are happy to provide you with support regarding this issue for $5000/day" Then if they accept, proceed to do nothing for 10 days, then reply you find none of your code is impacted and they are safe then bill them $50k.

It's fraud to bill someone T&M for time that wasn't actually spent. You're better off quoting it fixed-fee. :)

Bill hourly with an 80 hour minimum. Then you can give them an invoice for 5 minutes to type the email and bill them for 80 hours.

Re: LogJ4 Security Inquiry – Response Required

#12

Post by trevormcneal »

The first email looks like someone who had zero idea of what they were doing, just did some dependency scanning and got your name/email there, probably these emails were sent to everything that they could find.

Quite well handled, not arrogant, not bending over and doing whatever they say, but being honest.

If curl is impacted or not, may not really matters for them, usually these companies go after compliance and someone who they can blame when things go wrong.

Re: LogJ4 Security Inquiry – Response Required

#13

Post by csdvrx »

BiteCode_dev wrote: post #6

It's actually fantastic to receive such email. You can answer: "We are happy to provide you with support regarding this issue for $5000/day" Then if they accept, proceed to do nothing for 10 days, then reply you find none of your code is impacted and they are safe then bill them $50k.

> proceed to do nothing for 10 days

That would be fraud. No, start grep on the source code and a few things like that, then provide the results: "a detailed audit found no reference to log4js, so another audit was started which found no reference to any java code in the C source; it was repeated 5 times to confirm these promising results. Another audit followed the Boltzman brain hypothesis to check if the affected log4js binary code could not be spontaneously generated during compilation, by following a Monte Carlo simulation to check for various length of binary data that would match the log4j binary code. (...)

Finally, to avoid this extremely remote risk, the code changed to switch to reproducible builts, which can guarantee this will not happen"

Re: LogJ4 Security Inquiry – Response Required

#15

Post by trevormcneal »

kube-system wrote: post #8
BiteCode_dev wrote: post #6

It's actually fantastic to receive such email. You can answer: "We are happy to provide you with support regarding this issue for $5000/day" Then if they accept, proceed to do nothing for 10 days, then reply you find none of your code is impacted and they are safe then bill them $50k.

It's fraud to bill someone T&M for time that wasn't actually spent. You're better off quoting it fixed-fee. :)

well said, and these companies have way too many lawyers with free time to keep suing you, even if you are right and the judge solves the case in your favour, not always it is required to cover legal expenses and the amount of legal fees burned on it won't worth.

Fixed fee or monthly "support contract", with minimum of 1year.

Re: LogJ4 Security Inquiry – Response Required

#16

Post by nsoqo »

kube-system wrote: post #8
BiteCode_dev wrote: post #6

It's actually fantastic to receive such email. You can answer: "We are happy to provide you with support regarding this issue for $5000/day" Then if they accept, proceed to do nothing for 10 days, then reply you find none of your code is impacted and they are safe then bill them $50k.

It's fraud to bill someone T&M for time that wasn't actually spent. You're better off quoting it fixed-fee. :)

“I had Martin explain to me three times what he got arrested for because it sounds an awful lot like what I do here every day.”

Re: LogJ4 Security Inquiry – Response Required

#18

Post by jaywalk »

perihelions wrote: post #14

> "Thank you for your reply. Are you saying that we are not a customer of your organization?" Isn't this the sort of question you'd ask your own side, first?

In a Fortune 500 company, I'd imagine it could be quite difficult to definitively prove that they are not a customer of any one organization.

The company I work for is not Fortune 500, but we have several Fortune 500 customers. The amount of inane bullshit we have to deal with as a result is mind-boggling.

Re: LogJ4 Security Inquiry – Response Required

#20

Post by cryptonector »

rmoriz wrote: post #7

As far as I learned, a couple of big companies are sending this kind of mail to every provider, partner or copyright owner of code that they could find. I assume some developer/supplier used curl and provided a list of third party code and licenses they use. In the aftermath of the log4j incident, companies now target everyone about this issue partly to learn about potential exposure that they are not aware yet, eg e…

It's a really dumb approach to vulnerability management for CYA. Spray and pray that the regulators are assuaged. It might even work as far as that goes.

But obviously, it's not a sound approach to actual vulnerability management.

Post reply on HN