Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

twitter.com

Post reply on HN
Print view View original

301–310 of 476 posts

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#301

Post by andreareina »

waheoo wrote: post #280
Delk wrote: post #226

Earlier quoted context omitted.

You either have way more grit at arguing than most people or you haven't worked at a large and cumbersome organization. I know most people at those kinds of organizations just don't have the grit to fight every one of those battles all over again, and choose to do the things they can affect with reasonable effort instead. I'm not saying that grit would be a bad thing to have. I appreciate the people who do it. But yo…

I agree with your sentiment in general, but this is telling a dumbass where to go. Its not a hard argument to win. Md5 here is fine, its not a security check.

Not hard to win if everyone is being reasonable. Given an auditor that thinks all uses of MD5 are proscribed, what would you put the odds of them being reasonable at?

ETA: per 'kbenson it's not hard to conceive of a situation where proscribing MD5 is reasonable. Taking 'skissane's account at face value is probably reasonable, but my implicit assumption that the auditor would not explain if pressed isn't being charitable.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#302

Post by jasonladuke0311 »

triangleman wrote: post #289
xenophonf wrote: post #245

Earlier quoted context omitted.

That’s me. I’m that asshat. It’s called defense in depth. I recommend automating certificate issuance and renewal. It’s totally worth it.

Book or tutorial recommendations please.

https://certbot.eff.org/

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#303

Post by andreareina »

kbenson wrote: post #300
waheoo wrote: post #280

Earlier quoted context omitted.

I agree with your sentiment in general, but this is telling a dumbass where to go. Its not a hard argument to win. Md5 here is fine, its not a security check.

Sometimes the point isn't technical, but social. So MD5 isn't used for security purposes right now. At some point someone will want some hashing function, and they'll probably look at what the code already uses. The last thing you want is someone a bit clueless goi g "it was good enough there, it's good enough here" and using MD5 where they shouldn't. Removing it from a codebase helps with that problem. The problem h…

Isn't that what code review is for? To me that sounds like arguing against string formatting because someone could think it's ok for SQL queries.

An auditor's job doesn't end at saying what things should be changed, it should include why as well (granted, we don't know the full content of the auditor's report here, maybe they did say why).

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#304

Post by Spooky23 »

AlotOfReading wrote: post #268
sjg007 wrote: post #188

Earlier quoted context omitted.

Antiviruses will quarantine compiler output...

At one company, Symantec would also quarantine the compiler and build system. It certainly made builds exciting to have the antivirus playing Russian roulette with the entire toolchain.

Of course many places have replaced dopey AV with creepier advanced tools like ATP or CrowdStrike.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#305

Post by Spooky23 »

j1elo wrote: post #173
schmichael wrote: post #4

Earlier quoted context omitted.

Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.

Gmail won't even let you send a JAR file, or a zip you made out of a project where it happens to be a .jar file somewhere deep in some random subdirectory.

IIRC, You can do it by embedded the content into an Office file, which is a zip file.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#306

Post by doliveira »

greedo wrote: post #215
restingrobot wrote: post #179

Earlier quoted context omitted.

So much this. My company just got done shelling out a ton of money for some asshat to tell me that we can't use http on a dev server.

It's worse when the asshat convinces your manager that every internal site, whether dev or not needs https. Certs everywhere. Our team spends a decent % of our time generating and managing certs...

Does your organization disable the "Non-secure" prompt in the browser as well? If not, I'd say that it does seem like a security risk to train your users to ignore browser warnings like that.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#308

Post by Spooky23 »

heavenlyblue wrote: post #165
skissane wrote: post #135

Earlier quoted context omitted.

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

You don’t actually need to listen to auditors. People like you (who can’t be bothered to argue because it’s apparently too hard) is the reason that smartass is still selling their services.

Sometimes an inexperienced auditor will show a minor finding that is a sign of a bigger issue. For example, if Windows is in FIPS mode, some MD5 functions will be disabled.

If you need to be operating in FIPS 140 mode, that may be a problem of some consequence.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#309

Post by jack1243star »

still_grokking wrote: post #227
deathanatos wrote: post #142

Earlier quoted context omitted.

> Man doesn't always mean male, or does it? Not necessarily, but see: https://en.wikipedia.org/wiki/Gender_neutrality_in_English#D... The link is about the debate as it is, but I would also encourage the use of good faith in interpreting any speaker: that is, assuming a person referring to "mankind" likely means all humans without exclusion based on gender or sex, and requiring some other material evidence before pre…

No clue about French but in German they started to use both versions at the same time glued together in made-up "special" forms. It's like using "he/she" for every noun . This makes texts completely unreadable and you need even browser extensions[1] to not go crazy with all that gendered BS language! OK, I exaggerate, there are still people that don't try to be "politically correct" and still use proper language, and…

Thanks for sharing. As a German learner this is quite fascinating to know.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#310

Post by kadoban »

andreareina wrote: post #303
kbenson wrote: post #300

Earlier quoted context omitted.

Sometimes the point isn't technical, but social. So MD5 isn't used for security purposes right now. At some point someone will want some hashing function, and they'll probably look at what the code already uses. The last thing you want is someone a bit clueless goi g "it was good enough there, it's good enough here" and using MD5 where they shouldn't. Removing it from a codebase helps with that problem. The problem h…

Isn't that what code review is for? To me that sounds like arguing against string formatting because someone could think it's ok for SQL queries. An auditor's job doesn't end at saying what things should be changed, it should include why as well (granted, we don't know the full content of the auditor's report here, maybe they did say why).

Code reviews are good checks. Making it more difficult for dumb ideas to show up in a code review and possibly be missed is also good.

If using md5 had any real benefit I'd say leave it, but what are you gaining?

Post reply on HN