Binaries unique to SpaceX, maybe related to a server or contract with SpaceX?
I've heard that it's apparently SpaceX camera drivers?
20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
201–210 of 476 posts
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#202Earlier quoted context omitted.
Usually this. Or in my workplace, an image. Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.
I've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.
It's true, and often it's not laziness - corporate security measures are often focused only on denying access, and they're so overbearing that, were they followed to the letter, they could easily shut the company down. It's through workarounds that actual work gets done.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#203Earlier quoted context omitted.
But what if manhole is just mankind hole? (It probably isn't, I didn't look it up). Man doesn't always mean male, or does it?
> Man doesn't always mean male, or does it? Not necessarily, but see: https://en.wikipedia.org/wiki/Gender_neutrality_in_English#D... The link is about the debate as it is, but I would also encourage the use of good faith in interpreting any speaker: that is, assuming a person referring to "mankind" likely means all humans without exclusion based on gender or sex, and requiring some other material evidence before pre…
Believe it or not, we introduced a variant of bash brace expansion (except with implicit braces and dots instead of commas) in our grammar, named it “écriture inclusive”, and called it a day.
The way it kicks words previously loaded with neutrality in the curb but happened to have the same spelling as the gendered one, and entrenches a two-gender paradigm boggles the mind as to how it flies in the face of any form of inclusivity.
That and I still don’t know how to read “le.a fermi.er.ère” aloud. It’s just as ridiculous as “cédérom” because Astérix puts up a show at standing against the invader.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#204Earlier quoted context omitted.
Because until this thing gets diffused and dissected by everyone and their mothers, the law is likely to view it as publication of confidential trade secrets, and people who can be confirmed to be spreading such things can get federal time, e.g. [1] for example. Using a VPN is the barest of mechanisms to try to obscure your identity to avoid this sort of punishment. [1] https://www.wsj.com/articles/SB1000142405297020…
Right but if you just download without seeding, no crime is being committed, yes? So seems like the barest you can do is "disable seeding", not "use a VPN".
Depends heavily on the jurisdiction, I am afraid. This exact case was used as a precedent where I'm from (Czech Republic) that no, merely downloading over BitTorrent still constitutes "sharing copyrighted material".
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#205Earlier quoted context omitted.
this is hilarious
I've seen similar rigidity from security audits. Stuff like "version 10.5.2 (released last week) of this software introduced a security bug that was fixed in 11.0 (released today), we need you to update from 10.5.1 (released last week + 1 day) to 11.0 now because our audit tool says so".
Ah yes and also the vendor helpfully changed the API and did a complete rewrite in v11.0. Think about all the neat new things you will get to learn!
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#206Earlier quoted context omitted.
Makes perfect sense. Defense in depth, if you can grep the source code and not find any references to md5, then you have quickly verified that the code probably doesn't use md5. This you can easily verify again later, you can even make a test for it :) Even if in practice this had no impact, removing md5 usage, will make it harder to accidentally introduce it in the future.
// We use MD5 to check if config files are changed. This is not used anywhere else. typedef DigestMD5 ConfigFileHasher;
Until someone repurposes that thing to do something that is security-sensitive and forgets to remove the comment, misleading the next auditors.
I always assume that people from the future who are going to touch my code are really dumb people, so I try to have as few traps as possible for them.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#207Earlier quoted context omitted.
Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…
You don’t actually need to listen to auditors. People like you (who can’t be bothered to argue because it’s apparently too hard) is the reason that smartass is still selling their services.
Sometimes customers demand security audits as part of sales contracts. If it is a high enough value deal, the company may decide it is in their business best interest to say yes. In that scenario, not listening to the security auditor is not a viable option. You need to keep them onside to keep the customer onside.
Similarly, sometimes in order to sell products to government agencies you need to get security audits done. In that scenario, you have to listen to the security auditor and keep them onside, because if you don't keep them happy your ability to sell the product to the government is impeded.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#208Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#209> If you find password protected zips in the release the password is probably either "Intel123" or "intel123". This was not set by me or my source, this is how it was aquired from Intel. Can't say I'm surprised, people are lazy. Another large tech company I used to work for commonly used an only-slightly more complex password. But it was never changed, so people who had left the team still could have access to things…
I knew one company who used the same password for bios as wifi.
Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions
#210Earlier quoted context omitted.
This can't be real... are you serious? It sounds like one of those silly buisness parabels!
It sounds like Dell’s iDRAC somehow. (Not that it is, but iDRAC had me scared more often than not)
The time iDrac annoyed me the most is when I bricked a server trying to update it.
I made the terrible mistake of jumping too far between versions and the update broke iDrac and thus the server. There was no warning on Dell's website nor any when I applied the update. I only found out what happened after some googling where I found the upgrade path I should have taken.
This is just terrible quality control and software engineering.