Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LogJ4 Security Inquiry – Response Required

daniel.haxx.se

Post reply on HN
Print view View original

21–30 of 128 posts

Re: LogJ4 Security Inquiry – Response Required

#21

Post by zokier »

I think it is pretty easy to see how this sort of thing happens:

1. Someone decides that we need inventory of all the libraries used (iirc requirement for some certifications and generally not a bad practice)

2. A system (/excel sheet) is enrolled where you have fields like $our_product, $library_used, $vendor_email

3. A dev, not quite understanding the point, dutifully fills in the data for the project they are working on

4. No-one reviews the data

5. Crisis strikes, so mass-send email to all vendors how they are handling it

Problem here is around point 4.; for the process to work, someone should have reviewed the data to check that the used libraries are from vendors with some sort of support arrangement.

I think the reply they provided is pretty promising, it makes it sound like they wanted to be a customer but are not only due an oversight.

Re: LogJ4 Security Inquiry – Response Required

#22

Post by verytrivial »

For everyone boggling at the tone of the email, stop for a moment and have a guess at how many different sources of software they think the average large corp has on their books let alone on their infra. It can literally be hundreds or thousands of different sources. And each of those will have their own topology.

This is clearly a scatter-gun survey because they're realised they really have no idea of their exposure. (And before you re-boggle at that, there's a whole business ecosystem in just being able to answer that question let alone do anything about security issues.)

Re: LogJ4 Security Inquiry – Response Required

#23

Post by notyourwork »

I find it a bit sad that a tech literate group is bashing a non-literate group fo people. The entire reason your salary is much larger than many other career paths is because of your ability to deal with technology. The premise that when the less educated and informed try to question something they don't understand only to be left with pandering and jabs is disingenuous. The questions although perhaps better phrased by someone with a more tech focused background are fine questions for a business to ask. Stop being douchebags and grow up.

Re: LogJ4 Security Inquiry – Response Required

#24

Post by deltree7 »

OK, a large corporation legal team doesn't understand the nuance of ownership of open-source software.

Do we mock every single open source guy who displays the same amount of cluelessness about the inner workings of a business because I see plenty of that displayed here and everywhere else.

Re: LogJ4 Security Inquiry – Response Required

#25

Post by 0xbadcafebee »

Welcome to Corporate Life. Somebody at the top says "Make sure we find out from all vendors what their log4j impact is", and that trickles down until some poor sap in InfoSec is told to do it. And of course "all vendors" includes "open source vendors", aka some dude named Carl in Uzbekistan who wrote a Node.js module. Since InfoSec sap shouldn't even have been tasked with this ridiculous ask, and he's got 10,000 of them to send, he sends a form letter.

Re: LogJ4 Security Inquiry – Response Required

#27

Post by zitterbewegung »

BiteCode_dev wrote: post #6

It's actually fantastic to receive such email. You can answer: "We are happy to provide you with support regarding this issue for $5000/day" Then if they accept, proceed to do nothing for 10 days, then reply you find none of your code is impacted and they are safe then bill them $50k.

There was a HN post about selling to the Enterprise market. Doing it the way that was described there would be. Also, to not perform a scam as other posts here would be.

1. Insist that you need to talk to upper management until you get to the CEO.

2. Once there you need to sell them on a Fixed fee contract for five engineers so let’s say $1MM or more

3. Actually create a few scripts that run the log4j scanner from Google.

4. Have an extended support contract by doing this yearly at $1MM.

Re: LogJ4 Security Inquiry – Response Required

#28

Post by gitfan86 »

csdvrx wrote: post #13
BiteCode_dev wrote: post #6

It's actually fantastic to receive such email. You can answer: "We are happy to provide you with support regarding this issue for $5000/day" Then if they accept, proceed to do nothing for 10 days, then reply you find none of your code is impacted and they are safe then bill them $50k.

> proceed to do nothing for 10 days That would be fraud. No, start grep on the source code and a few things like that, then provide the results: "a detailed audit found no reference to log4js, so another audit was started which found no reference to any java code in the C source; it was repeated 5 times to confirm these promising results. Another audit followed the Boltzman brain hypothesis to check if the affected l…

First you start with some project planning sprints. Later on you will begin the implementation of the command line module exercises.

Re: LogJ4 Security Inquiry – Response Required

#29

Post by Mvandenbergh »

deltree7 wrote: post #24

OK, a large corporation legal team doesn't understand the nuance of ownership of open-source software. Do we mock every single open source guy who displays the same amount of cluelessness about the inner workings of a business because I see plenty of that displayed here and everywhere else.

Understanding the nuances of ownership and who is responsible for what is quite an important skill for corporate lawyers.
Post reply on HN