Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosec company pwned by 4chan user

maia.crimew.gay

Post reply on HN
Print view View original

191–200 of 234 posts

Re: Infosec company pwned by 4chan user

#191

Post by ilyt »

doodlesdev wrote: post #73
flatline wrote: post #48

Earlier quoted context omitted.

Is there an F/OSS alternative to Jenkins that I’m not aware of?

- Woodpecker CI: https://woodpecker-ci.org/ - Drone CI: https://www.drone.io/ - Buildbot: https://buildbot.net/ - Gitea Actions: https://docs.gitea.io/en-us/usage/actions/overview/ - Fogejo Actions: https://forgejo.org/2023-02-27-forgejo-actions/ - GitLab Runners: https://gitlab.com/gitlab-org/gitlab-runner You could also use Ansible playbooks/roles to run your build, although that's going to be a bit more manual: ht…

Which one tells you which test failed and what your code coverage is on one page ?

Re: Infosec company pwned by 4chan user

#192

Post by ilyt »

sidlls wrote: post #23
code_runner wrote: post #20

Earlier quoted context omitted.

jenkins is old and crusty, but it works and works well. if the UI for a build tool looks too fancy, my faith in it drops to 0 almost immediately.

It doesn’t work well. It’s the JIRA of CI/CD: it is entrenched and does multiple things but doesn’t do any one thing well, and the people that decide what to buy aren’t the people who are forced to use it so they don’t care about its quality so much

It's not great CD bit you need entirely different system just to display code coverage in near-every other CI

Near-every other CI also can't just browse which tests failed and with what message without digging directly into logs

Re: Infosec company pwned by 4chan user

#193

Post by arepublicadoceu »

shrimp_emoji wrote: post #180
Miraste wrote: post #133

Earlier quoted context omitted.

X11 is finally, finally on the way out. I have a lot of gripes with Wayland, but the day I stop needing to dive into xrandr and figure out why the screen is rotated but the mouse coordinates aren't or some other 1990s level problem will be a happy one. QWERTY seems to be too embedded even for that, but I wonder if it gets closer to replacement the higher the percentage of software keyboards climbs vs physical ones.

> but the day I stop needing to dive into xrandr and figure out why the screen is rotated but the mouse coordinates aren't or some other 1990s level problem will be a happy one. I'm sympathetic to wanting legacy mindhorrors replaced with modern stuff, but genuine question: When do you ever have such problems xD I've multimonitored on X11 for like 4 years and never experienced that.

Have you tried to multimonitor different combinations of HiDPI + regular DPI on x11? Last time I tried to make different scaling displays work together on x11 the experience was so nightmarish that I went back to windows.

Re: Infosec company pwned by 4chan user

#194

Post by time0ut »

deng wrote: post #137
dmbche wrote: post #2

"however, they made one of the most comedic mistakes you can still make while setting up jenkins (im actually not sure which misconfiguration leads to this): the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url. genius."

No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.

An externally accessible Jenkins instance is just asking to get pwned.

I worked for a company a couple years ago that had Jenkins running on a Windows EC2 with a bare public IP, no TLS, and a single set of admin credentials shared by everyone. Also, the host did double duty as some sort of DBA jump box and had every possible credential.

It was like in-defense in depth. I tried to explain how crazy it was. They weren’t interested in fixing it. I moved on.

Some companies just don’t care… soc 2 btw.

Re: Infosec company pwned by 4chan user

#195

Post by jorams »

deng wrote: post #144
supermatt wrote: post #141

Earlier quoted context omitted.

Given the frequency with which I seem to update nokogiri on a rails instance, i assumed libxml2 would hold that award: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libxml2 But sure enough, jenkins FAR outweighs it: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jenkins

And that's just the ones that get reported. Since core Jenkins is pretty bare-bones, most instances also have many plugins installed, and most of those aren't properly reviewed at all.

The vast majority of those Jenkins CVEs seem to be for a wide variety of plugins, so it seems someone is putting in quite a bit of work to review them.

Re: Infosec company pwned by 4chan user

#197

Post by duxup »

deng wrote: post #137
dmbche wrote: post #2

"however, they made one of the most comedic mistakes you can still make while setting up jenkins (im actually not sure which misconfiguration leads to this): the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url. genius."

No, the most comedic mistake is to have a public-facing Jenkins running. I mean in general you wouldn't make your CI accessible from the outside, but especially not Jenkins. That software has probably more CVEs every year than all of our other tooling combined.

Why the heck would anyone create an externally accessible Jenkins?

Re: Infosec company pwned by 4chan user

#199

Post by ianburrell »

JasonFruit wrote: post #157
orhmeh09 wrote: post #129

Earlier quoted context omitted.

FYI, the author uses it/she pronouns.

So it uses it/she pronouns? Usually the object pronoun is second; does that mean that it wants people to call she "it" unless they're doing something to she? That's off the chain, and sounds like meta-trolling.

There are two forms of pronouns. The correct form is multiple pronouns, “he/them” or “it/she”. They are alternatives, both can be used. I think the first is preferred.

The second form is different cases, “he/him”. I have theory that people started using that because they didn’t want to put just “he”. They were following the multiple case form and it stuck. People aren’t really specifying cases because nobody uses different cases and nobody puts cases in the multiple pronouns form.

Re: Infosec company pwned by 4chan user

#200

Post by Miraste »

shrimp_emoji wrote: post #180
Miraste wrote: post #133

Earlier quoted context omitted.

X11 is finally, finally on the way out. I have a lot of gripes with Wayland, but the day I stop needing to dive into xrandr and figure out why the screen is rotated but the mouse coordinates aren't or some other 1990s level problem will be a happy one. QWERTY seems to be too embedded even for that, but I wonder if it gets closer to replacement the higher the percentage of software keyboards climbs vs physical ones.

> but the day I stop needing to dive into xrandr and figure out why the screen is rotated but the mouse coordinates aren't or some other 1990s level problem will be a happy one. I'm sympathetic to wanting legacy mindhorrors replaced with modern stuff, but genuine question: When do you ever have such problems xD I've multimonitored on X11 for like 4 years and never experienced that.

I run into problems like that a lot; I guess I do edge case things. That particular example was on an Intel Atom Bay Trail tablet (garbage architecture) I resurrected with a lightweight distro. It was a huge improvement, but there was no support for auto rotation, and manual rotation turned the screen but not the mouse coordinates sent by the digitizer. This meant touch inputs were mirrored or flipped or both.

This wasn't an old-school problem, either, it was three months ago.

Post reply on HN