271–280 of 476 posts
Earlier quoted context omitted.
So much this. My company just got done shelling out a ton of money for some asshat to tell me that we can't use http on a dev server.
I mean, I mandate https in dev, but it sure isn't for security. It's so that auth works in dev and no changes are required to push prod
Earlier quoted context omitted.
It will be more or less impossible to prove or disprove that anyone obtained some crucial information from there. The info will always somehow make it's way into the places it's needed eventually.
It doesn’t matter if it’s provable or not, most developers won’t risk it especially if they want to keep their jobs or be hireable. If you review the content and publish say a blog post, even without legal repercussions it can impact your ability to be hired in the future since everything you do from that point can be tainted. So if you do look you should keep it quite or publish it under a pen name that you can’t ev…
Someone reads the code, mentions it to a friend, who adds it to a blog post, which gets cited in a wiki, which gets read by a developer unaware of the source. If the information is useful, it will end up getting spread.
Earlier quoted context omitted.
Usually this. Or in my workplace, an image. Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.
Antiviruses will quarantine compiler output...
Earlier quoted context omitted.
The issue is not md5. The issue one wants to detect is weak hash functions used in cases where they're not appropriate. The fact that crc32 passed means that any obscure hash function would have passed too, even if it had been used in a context were it isn't appropriate. All it means that the audit is superficial and doesn't catch the error category, just famous examples within that category. That kind of superficial…
Next up: Replace MD5 with BASE64+ROT13. Significantly worse functionality AND performance, but sounds more secure (to a layman) and doesn't trigger the "MD5" alert...
Earlier quoted context omitted.
You just gave them money. They didn't coerce you. It would be different if they flashed a weapon.
It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime. Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
Earlier quoted context omitted.
for not using gmail? The hooked me in school
For not sending binaries by email - there is no shame to being young in this case as it means never developing the bad habits. Before Dropbox and similiar it was far more a norm and various file sharing systems like SharePoint may wind up not actually used. Non-computer technical people often do so in companies all the time and practically use it as an ersatz version control system to the cringe of IT.
Earlier quoted context omitted.
Intel doesn't have a track record of shipping back doors, or even "bad faith" software really.
Isn't their whole management engine essentially one big (poorly secured) backdoor?
Earlier quoted context omitted.
Next up: Replace MD5 with BASE64+ROT13. Significantly worse functionality AND performance, but sounds more secure (to a layman) and doesn't trigger the "MD5" alert...
You joke, but an ex-security guy at my company literally told me “this file can’t be in plain text on disk. Base64 encode it”
(Unless the person looking over your shoulder has a really good memory and can remember the Base64, or decode it in their head. Or they have a camera.)
Earlier quoted context omitted.
It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime. Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a fil…
1. Find the server via nmap
2. Guess at some URLs until the server finally responded with some hidden data.
While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.
Earlier quoted context omitted.
You don’t actually need to listen to auditors. People like you (who can’t be bothered to argue because it’s apparently too hard) is the reason that smartass is still selling their services.
You either have way more grit at arguing than most people or you haven't worked at a large and cumbersome organization. I know most people at those kinds of organizations just don't have the grit to fight every one of those battles all over again, and choose to do the things they can affect with reasonable effort instead. I'm not saying that grit would be a bad thing to have. I appreciate the people who do it. But yo…
Its not a hard argument to win. Md5 here is fine, its not a security check.