Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LogJ4 Security Inquiry – Response Required

daniel.haxx.se

Post reply on HN
Print view View original

101–110 of 128 posts

Re: LogJ4 Security Inquiry – Response Required

#101

Post by tgv »

dagw wrote: post #50
softwarebeware wrote: post #2

"...The level of ignorance and incompetence shown in this single email is mind-boggling...no code I’ve ever been involved with or have my copyright use log4j and any rookie or better engineer could easily verify that..." Yeah, well, I've been quite shocked how rookie some F500 devs can be and how dysfunctional large corporations can also be. Probably what happened here is someone wrote a script that compiled the depe…

When I worked at a large, but not F500, company I had to once every 6-12 month or so fill in a spreadsheet with all third-party dependencies, with their licenses and some other info, the project I was working on used. I then emailed this to a mystery person and never heard anything back ever. I can easily see someone pulling out these spreadsheets and just emailing away without any developer, rookie or otherwise, bei…

Yeah, but that's still a dumb thing to do. They're basically delegating their IT infrastructure's security status to some low-level help in the legal department. What could possibly go wrong?

Re: LogJ4 Security Inquiry – Response Required

#102

Post by rootusrootus »

0x500x79 wrote: post #71
matheusmoreira wrote: post #65

Earlier quoted context omitted.

> At the scale this company is running the person/team sending out these emails do not have time to dig in and understand each dependency they are sending emails on. That alone is extremely disrespectful, it means they couldn't care less about the time of open source software maintainers. To say nothing of their "request" for review.

It's not about open source maintainers. This isn't an "open source" problem further than the fact that Daniel's software is used in a product they are using. Daniel could take a couple of seconds to ignore this email and there was very little time wasted. The real "disrespect" should be whatever engineer put Daniel's name into the spreadsheet that blasted out these emails. Someone didn't do their job and is checking…

> The real "disrespect" should be whatever engineer put Daniel's name into the spreadsheet that blasted out these emails.

Agree 100%. Any engineer that got far enough to put this email address into a spreadsheet knew damn well it was inappropriate to do so. They should have put their own email address, as they made the choice to use downloaded software in their project and become responsible for that decision.

Re: LogJ4 Security Inquiry – Response Required

#103

Post by deltree7 »

josephcsible wrote: post #48
deltree7 wrote: post #24

OK, a large corporation legal team doesn't understand the nuance of ownership of open-source software. Do we mock every single open source guy who displays the same amount of cluelessness about the inner workings of a business because I see plenty of that displayed here and everywhere else.

"Don't expect people to do work for you if you're not paying them" is obvious to anyone with a brain. I fail to see how nuance comes into this.

Nuance is, you don't even know what the end goal of the communication is.

It's as dumb as mocking a scam email/phone call telling "You are so wrong about me". The end goal of the scammer is to make money for the total time he put. Sure, the scammer can go in great detail about your life and tailor the scamming for you, but that's not his best ROI. His best ROI is a generic message sent to everyone.

Oh and "Ha Ha Ha, that you don't know that"

Re: LogJ4 Security Inquiry – Response Required

#104

Post by tremon »

0x500x79 wrote: post #71
matheusmoreira wrote: post #65

Earlier quoted context omitted.

> At the scale this company is running the person/team sending out these emails do not have time to dig in and understand each dependency they are sending emails on. That alone is extremely disrespectful, it means they couldn't care less about the time of open source software maintainers. To say nothing of their "request" for review.

It's not about open source maintainers. This isn't an "open source" problem further than the fact that Daniel's software is used in a product they are using. Daniel could take a couple of seconds to ignore this email and there was very little time wasted. The real "disrespect" should be whatever engineer put Daniel's name into the spreadsheet that blasted out these emails. Someone didn't do their job and is checking…

Daniel could take a couple of seconds to ignore this email and there was very little time wasted.

So, in your opinion, sending spam or robocalls is not in the least bit disrespectful to whomever is on the receiving end?

Re: LogJ4 Security Inquiry – Response Required

#105

Post by y4mi »

lowercased wrote: post #92
perihelions wrote: post #36

Earlier quoted context omitted.

> "No, start grep on the source code" Or print it out on hard copy, make interns read it line by line, then charge 400% of their labor as your management fee. What's the purpose of using regexps here? You're optimizing away your own revenue!

Also charge $1/page for the printing. Then ship it to them, in triplicate, and charge for the overnight shipping (it's an urgent bug after all).

Add a note that the lines at risk have been marked!

Re: LogJ4 Security Inquiry – Response Required

#106

Post by tremon »

perihelions wrote: post #36
csdvrx wrote: post #13

Earlier quoted context omitted.

> proceed to do nothing for 10 days That would be fraud. No, start grep on the source code and a few things like that, then provide the results: "a detailed audit found no reference to log4js, so another audit was started which found no reference to any java code in the C source; it was repeated 5 times to confirm these promising results. Another audit followed the Boltzman brain hypothesis to check if the affected l…

> "No, start grep on the source code" Or print it out on hard copy, make interns read it line by line, then charge 400% of their labor as your management fee. What's the purpose of using regexps here? You're optimizing away your own revenue!

There's no need to have actual interns read it, that would be unnecessarily cruel. Service fees don't need to be based on actual billable hours. You can charge 400% of the time it would take interns to read it without actually doing that, as long as your grep one-liner delivers the same value.

Re: LogJ4 Security Inquiry – Response Required

#107

Post by [deleted] »

0x500x79 wrote: post #71
matheusmoreira wrote: post #65

Earlier quoted context omitted.

> At the scale this company is running the person/team sending out these emails do not have time to dig in and understand each dependency they are sending emails on. That alone is extremely disrespectful, it means they couldn't care less about the time of open source software maintainers. To say nothing of their "request" for review.

It's not about open source maintainers. This isn't an "open source" problem further than the fact that Daniel's software is used in a product they are using. Daniel could take a couple of seconds to ignore this email and there was very little time wasted. The real "disrespect" should be whatever engineer put Daniel's name into the spreadsheet that blasted out these emails. Someone didn't do their job and is checking…

[deleted]

Re: LogJ4 Security Inquiry – Response Required

#108

Post by notyourwork »

kahrl wrote: post #73
notyourwork wrote: post #23

I find it a bit sad that a tech literate group is bashing a non-literate group fo people. The entire reason your salary is much larger than many other career paths is because of your ability to deal with technology. The premise that when the less educated and informed try to question something they don't understand only to be left with pandering and jabs is disingenuous. The questions although perhaps better phrased…

I find it sad that the security department of a Fortune 500 company is sending out emails demanding OSS maintainers respond within 24 hours or else. You can feel sorry for the poor sap that was forced to embarrass himself, but it doesn't change the fact that everyone here feels like that company can get bent.

Why should the company get bent? Because some executive caught wind of a critical zero day and decided to have their company mitigate damage the same as any other company.

Do you really think the security department in this specific company would not find this email dumb? In many cases, when things are reacted to hastily and in parallel its easy to take one action and generalize it to the whole company and not realize this is one of many actions the company took. No need to get bent out of shape over this and say this entire fortune 500 company is equally incompetent. If you think that you are not living in reality.

Re: LogJ4 Security Inquiry – Response Required

#109

Post by EvRev »

gitfan86 wrote: post #28
csdvrx wrote: post #13

Earlier quoted context omitted.

> proceed to do nothing for 10 days That would be fraud. No, start grep on the source code and a few things like that, then provide the results: "a detailed audit found no reference to log4js, so another audit was started which found no reference to any java code in the C source; it was repeated 5 times to confirm these promising results. Another audit followed the Boltzman brain hypothesis to check if the affected l…

First you start with some project planning sprints. Later on you will begin the implementation of the command line module exercises.

Yes, but does the other company pay for the retrospective? Or is the retro when we start to spend all the money that was billed?

Re: LogJ4 Security Inquiry – Response Required

#110

Post by specialist »

Tangent:

Wasn't Java's SecurityManager stuff supposed to prevent these kinds of exploits?

I haven't used log4j for ages, so I didn't know offhand. Somewhat curious, I gleened that none of the enterprisey stacks use SecurityManager. I guess I kinda understand; SecurityManager was fashioned and pitched for an ecosystem of applets, agents, and sandboxes.

Further, I then gleened there's a JSR to outright remove SecurityManager. With no apparent replacement, just some vague advice to roll your own capabilities based system.

So, however we got here, what's then plan? Run JVMs on top of something like OpenBSD's pledge?

Post reply on HN