401–410 of 476 posts
Earlier quoted context omitted.
We have to have antivirus on our Linux computers for compliance. Yes such a thing exists... https://www.mcafee.com/enterprise/en-us/products/virusscan-e...
There are legitimate use cases for anti virus on Linux, for instance when running mail or file servers.
Earlier quoted context omitted.
They have a "topup" now which allows you to get real, full-fat 1080p. Woohoo! I did actually add that to my subscription, and during lockdown have used it to re-watch Game of Thrones :)
I gave that a go but wasn't impressed by the 1080P quality. I suspect they're using a low bitrate.
Between that and whatever magic my OLED tv was doing, it looked pretty good to me.
Just a shame they haven't released it all in 4K/UHD yet...
Earlier quoted context omitted.
Next up: Replace MD5 with BASE64+ROT13. Significantly worse functionality AND performance, but sounds more secure (to a layman) and doesn't trigger the "MD5" alert...
You joke, but an ex-security guy at my company literally told me “this file can’t be in plain text on disk. Base64 encode it”
It's game over anyway if someone has a shell on your server but at least it complicates their life a bit.
Earlier quoted context omitted.
I have a feeling that these auditor people just make up bullshit when they can't find something real. The last few we have got have come up with total non issues marked as severe because they are easy to "exploit". Meanwhile I have been finding and fixing real security issues regularly. To be fair it would be extremely difficult for an external person to find issues in the limited time they have so the audit comes do…
One thing I learned when I worked in internal IT security when dealing with auditors was that they will boil the ocean to find an issue, so never be perfect and leave a few relatively easy but not obvious to spot issues for them to write up that don't actually affect the security of your environment. If you don't leave them this bait, they will spend weeks to find a trivial issue (like using MD5 to check for config f…
Earlier quoted context omitted.
I gave that a go but wasn't impressed by the 1080P quality. I suspect they're using a low bitrate.
Most likely. You can get the bitrate to display (when the video controls are up maybe?) if you wanted to take a look. Between that and whatever magic my OLED tv was doing, it looked pretty good to me. Just a shame they haven't released it all in 4K/UHD yet...
At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|
Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…
Earlier quoted context omitted.
Isn't that what code review is for? To me that sounds like arguing against string formatting because someone could think it's ok for SQL queries. An auditor's job doesn't end at saying what things should be changed, it should include why as well (granted, we don't know the full content of the auditor's report here, maybe they did say why).
Code reviews are good checks. Making it more difficult for dumb ideas to show up in a code review and possibly be missed is also good. If using md5 had any real benefit I'd say leave it, but what are you gaining?
Earlier quoted context omitted.
Most likely. You can get the bitrate to display (when the video controls are up maybe?) if you wanted to take a look. Between that and whatever magic my OLED tv was doing, it looked pretty good to me. Just a shame they haven't released it all in 4K/UHD yet...
I doubt they'll offer 4K. They want to push people toward their expensive satellite packages for that.
I was really hoping to get an HDR version of the "The long night", to address some of the banding and other visibility problems present in the episode, and maybe see a bit more of what went on. But there isn't one yet. So I watched it with the lights out so that my eyes adjusted :)
But yeah, you're probably right, NowTv has massive potential to undercut their main offering.
Earlier quoted context omitted.
Code reviews are good checks. Making it more difficult for dumb ideas to show up in a code review and possibly be missed is also good. If using md5 had any real benefit I'd say leave it, but what are you gaining?
because CRC is actually worse for checking file content collisions (not that MD5 is perfect either).
So use SHA-1 or SHA-2 or SHA-3 or if you really hate NIST standards for some reason then CubeHash or Skein or Blake2 or ...