Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

241–250 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#241

Post by JaggedNZ »

Polylactic_acid wrote: post #225
skissane wrote: post #207

Earlier quoted context omitted.

Sometimes customers demand security audits as part of sales contracts. If it is a high enough value deal, the company may decide it is in their business best interest to say yes. In that scenario, not listening to the security auditor is not a viable option. You need to keep them onside to keep the customer onside. Similarly, sometimes in order to sell products to government agencies you need to get security audits d…

I have a feeling that these auditor people just make up bullshit when they can't find something real. The last few we have got have come up with total non issues marked as severe because they are easy to "exploit". Meanwhile I have been finding and fixing real security issues regularly. To be fair it would be extremely difficult for an external person to find issues in the limited time they have so the audit comes do…

I've had audits like that, many are just for CYA and I'm often the dev patching obscure (or not so obscure) security issues.

Honestly, I'm quite happy to have an auditor nitpick a few non-issues if the alternative is risking releasing an app that has a basic sql injection attack that wiggled past code review due to code complexity.

I've also had an external audit that found an unreported security issue in a new part of a widely used framework, so there are auditors out there that do a good job of finding legitimate things.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#242

Post by totetsu »

sjg007 wrote: post #189
Delk wrote: post #184

Earlier quoted context omitted.

To be fair, emailing binaries (apart from known types such as images, PDFs, etc.) is a rare enough use case for legitimate purposes and an easy enough way of spamming malware to clueless random people that it's probably a reasonable default for gmail. Having an option to allow them might be okay though. (I barely use gmail so I don't know if it has one or not.)

Ah you must be young...

for not using gmail? The hooked me in school

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#243

Post by totetsu »

hawkoy wrote: post #71
ColanR wrote: post #54

Earlier quoted context omitted.

The countries of origin of the peers downloading that torrent is pretty cool to see. A fairly broad cross-section of the world.

Not reliable. Most people torrenting this are hopefully using a vpn.

so.. I shouldn't have clicked that link on my office network?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#244

Post by marricks »

orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

I'm really not at all interested in people explaining to me how finding mentions of back doors in technology used in millions of computers is probably OK because it may mean something else.

Given US security apparatus clearly values and desire these back doors and have the necessary power to coerce companies to making them, generalizing the use of "back door" as a term for debugging or w/e seems almost expected.

Even if they are for debugging "oops it's on in production!" is a great cover because none of these companies will EVER admit back doors were required by the government.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#245

Post by xenophonf »

greedo wrote: post #215
restingrobot wrote: post #179

Earlier quoted context omitted.

So much this. My company just got done shelling out a ton of money for some asshat to tell me that we can't use http on a dev server.

It's worse when the asshat convinces your manager that every internal site, whether dev or not needs https. Certs everywhere. Our team spends a decent % of our time generating and managing certs...

That’s me. I’m that asshat. It’s called defense in depth. I recommend automating certificate issuance and renewal. It’s totally worth it.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#246

Post by Nasrudith »

TeMPOraL wrote: post #202
myself248 wrote: post #97

Earlier quoted context omitted.

I've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.

It's true, and often it's not laziness - corporate security measures are often focused only on denying access, and they're so overbearing that, were they followed to the letter, they could easily shut the company down. It's through workarounds that actual work gets done.

Sounds like a large organizational incentive intergration failure where subpieces are at odds such that they care more about dodging blame and outside of their domain it isn't their problem. "Not My Fault/Not My Problem" as a toxic approach making balancing decisions worse.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#247

Post by rvnx »

dcow wrote: post #198
dleslie wrote: post #17

Earlier quoted context omitted.

Of course it's not legal. This is exfiltrated intellectual property being shared without license.

I don't believe this is accurate or in any way obvious even if this is the stance the courts would ultimately take. These files were downloaded from a publicly available CDN server discovered while browsing the internet. No authorization mechanisms were bypassed, no computer systems were hacked. These files are the result of a GET request to an Akamai server that happened to be hosting the files. Despite how this wil…

Not sure about US but in France it's considered a quite serious crime

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#249

Post by Alekhine »

totetsu wrote: post #242
sjg007 wrote: post #189

Earlier quoted context omitted.

Ah you must be young...

for not using gmail? The hooked me in school

He means there used to be a time when people would mail binaries to each other more often, before they got too big and DRM'ed for that.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#250

Post by Nasrudith »

totetsu wrote: post #242
sjg007 wrote: post #189

Earlier quoted context omitted.

Ah you must be young...

for not using gmail? The hooked me in school

For not sending binaries by email - there is no shame to being young in this case as it means never developing the bad habits.

Before Dropbox and similiar it was far more a norm and various file sharing systems like SharePoint may wind up not actually used. Non-computer technical people often do so in companies all the time and practically use it as an ersatz version control system to the cringe of IT.

Post reply on HN