131–140 of 459 posts
Earlier quoted context omitted.
In the case of msft/crowdstrike isn't this exactly the opposite of what HN rallies against? The users installed crowdstrike on their own machines. Why should microsoft be the arbiter of what a user can do to their own system?
Microsoft determines who they give root access signing keys to
Earlier quoted context omitted.
What if they incremented a number in a url on a publicly available website?
Is this a reference to a past event? I don't get it.
Earlier quoted context omitted.
What if they incremented a number in a url on a publicly available website?
Yeah I wouldn't have convicted weev either. There is a difference though. He used that incremented number to access actual user PII. These guys created a user with no PII and no actual malicious use.
Earlier quoted context omitted.
> 1. Ok, security is bad, what are you going to do? Go to different, competing security? Amazingly, you can do that. SFO doesn't use the TSA, for example.
Does it not? I fly out of SFO all the time and the experience is very similar. I guess I never checked if it was officially the TSA, but I never noticed any difference.
https://www.flysfo.com/about/airport-operations/safety-secur...
Earlier quoted context omitted.
They often do. The value of those kinds of blanket security audits is questionable, however. (This is one of the reasons I'm generally pro-OSS for digital infrastructure: security quickly becomes a compliance game at the scale of government, meaning that it's more about diligently completing checklists and demonstrating that diligence than about critically evaluating a component's security. OSS doesn't make software…
Well, the value is ok, if considered seriously. Also, any certificate bears a certificator company name. We can always say "company A was hacked despite having its security certified by company B". So that company B at least share some blame.
But yes, there are many standards for this (e.g. SOC Type 2 reports).
In defense of their utility, the good ones tend to focus on (a) whether a control/policy for a sensitive operation exists at all in the product/company & (b) whether those controls implemented are effectively adhered to during an audited period.
Earlier quoted context omitted.
Would that be https://id.me ? It's what the IRS uses.
That's of course the stupidest possible domain for a government website. (Or at least it's up there) Fundamentally, it has given control over the DNS records to a different country (.me == Montenegro). It's training people that really, any domain could be a government domain, you'll never know.
> We did not want to contact FlyCASS first as it appeared to be operated only by one person... It seems pretty remarkable that airlines are buying such a security sensitive piece of software from a one person shop. If you make it very far into selling any piece of SaaS software to most companies in corporate America, at the absolute minimum they're going to ask you for your SOC2 audit report. SOC2 is pretty damn easy…
You could be an "airline" by purchasing a couple of older airliners and converting them to cargo use. Is it valuable for new airlines to get started? Should we force them out of business because they don't already have the systems in place that take years to decades to build out? Should they pay $$$ for boutique systems designed for a large passenger airline when they have 2 aircraft flying 1 route between nowhere and nowhere?
Requirements and audits really aren't the answer here. The fundamental design problem is that the TSA has used authentication "airline XXX says you're an employee" with a very large blanket authorization "you're allowed to bypass all security checks at any airport nationwide" without even the basic step of "does your airline even operate here?"
Earlier quoted context omitted.
Would that be https://id.me ? It's what the IRS uses.
That's of course the stupidest possible domain for a government website. (Or at least it's up there) Fundamentally, it has given control over the DNS records to a different country (.me == Montenegro). It's training people that really, any domain could be a government domain, you'll never know.
Earlier quoted context omitted.
Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist
In the case of msft/crowdstrike isn't this exactly the opposite of what HN rallies against? The users installed crowdstrike on their own machines. Why should microsoft be the arbiter of what a user can do to their own system?