31–40 of 204 posts
We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?
Little experience with javadocs, so how do they fall?
Earlier quoted context omitted.
Can you expand on this a bit? I googled "ntlm proxy" and "sonatype nexus" and still have no idea what it is you've done but I'd like to understand.
Nexus Repository (commonly referred to as just "Nexus", which is confusing because Sonatype has several products called "Nexus $name") is a local artifact repository. Running it locally allows you to cache artifacts from external repositories like pypi.org or repo.maven.org, which is beneficial because it cuts down on the amount of outbound traffic required to install dependencies.
Earlier quoted context omitted.
Oh god this is horrible! Yeah, I can't believe how stupidly locked down some of these networks are. I once had an employer said they needed a "whitelist" of websites we wanted to visit instead of a "blacklist" of ones we shouldn't. That was an interesting day...
I had exactly this. We run a Saas and someone wrote an email saying that our server was down, and when we'd expect it to be up. Not having had a notification, I double checked from a couple of geographic locations that our application was indeed up and responding. After a bit of investigation, it turns out that they have to whitelist every unique address with their corporate IT. And had only whitelisted our primary c…
A tale as old as time: https://www.youtube.com/watch?v=uRGljemfwUE
Earlier quoted context omitted.
Nexus Repository (commonly referred to as just "Nexus", which is confusing because Sonatype has several products called "Nexus $name") is a local artifact repository. Running it locally allows you to cache artifacts from external repositories like pypi.org or repo.maven.org, which is beneficial because it cuts down on the amount of outbound traffic required to install dependencies.
The biggest win is not the bandwidth, it's that you have exactly what was used before in case you need it (audit/postmortem), or origin goes away.
But you are correct as well; that is an uncommon yet hugely beneficial reason to have an internal artifact repository.
Earlier quoted context omitted.
As a security guy, we are taught the CIA triad early and it's easy to forget. The A stands for availability and if you don't make things available, you're failing at your own job.
CI = ??
Confidentiality,
Integrity,
Availability.
There are other IT protection goals, including authenticity, privacy, reliability, and (non)repudiation.
Cannot judge by not knowing how he displays errors. But a question to HN public: Is opening unknown HTML under my domain within another window safe? Or is there any possibility to strip down any "permissions" to cookies, requests, resources etc for that dedicated page?
Earlier quoted context omitted.
CI = ??
I didn't know either, so I looked it up: The three initials stand for the three most important IT protection goals, often referred to as the "pillars of data security": Confidentiality, Integrity, Availability. There are other IT protection goals, including authenticity, privacy, reliability, and (non)repudiation.
These fall under integrity, confidentiality, availability, and integrity respectively! The CIA triad is pretty comprehensive!
If I want to push to GitHub when I am in the office, I have to VPN out of the office connection because Port 22 is blocked. And they wonder why I prefer to work from home?
I wonder what _showHtmlPage_ does? Did he just write something, something that allows 3rd party (corporate firewalls) inject HTML under his domain within TLS protected connection? Cannot judge by not knowing how he displays errors. But a question to HN public: Is opening unknown HTML under my domain within another window safe? Or is there any possibility to strip down any "permissions" to cookies, requests, resources…