411–420 of 476 posts
With stuff like this being exfiltraded (let’s admit if hackers got this they prob could have a whole ton of fab secrets) it won’t be long until America’s IP is all in the hands of China/Russia/Europe. We will have confirmation when China launch a ‘Xi Lake’ x86 compatible cpu...
The advice to try a password of “Intel123” on any protected files says it all. This organisation genuinely deserves whatever is coming for them.
For the life of me, I can't understand why people insist on making passwords with the name of the company in them. It's so absolutely stupid, but common.
Earlier quoted context omitted.
I've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.
> If you force users to trade convenience for security I _wish_ it was better security they were making the trade for. It often isn't though. These programs are large, expensive, and don't do much most of the time. I feel there's a perverse incentive for developers to make their AV products as noisy as is possible to justify their own existence. And yet.. even with full AV rollouts locked down at the highest level, b…
In most large corporations you are basically not allowed to send anything that could even potentially hide a virus except for maybe Office files (nobody yet built a compelling alternative to Powerpoint and Excel).
Typical rules already block all executable binaries, scripts and password protected archives (because they could hold binaries or scripts), etc. As a Java developer I have recently discovered my company started blocking *.java files.
Earlier quoted context omitted.
Sometimes the point isn't technical, but social. So MD5 isn't used for security purposes right now. At some point someone will want some hashing function, and they'll probably look at what the code already uses. The last thing you want is someone a bit clueless goi g "it was good enough there, it's good enough here" and using MD5 where they shouldn't. Removing it from a codebase helps with that problem. The problem h…
Isn't that what code review is for? To me that sounds like arguing against string formatting because someone could think it's ok for SQL queries. An auditor's job doesn't end at saying what things should be changed, it should include why as well (granted, we don't know the full content of the auditor's report here, maybe they did say why).
(1) Code is in part a communication medium. This says "We use MD5"
(2) Code changes. If some sees something cryptohashed, they may use it differently in 5 years.
Earlier quoted context omitted.
Which country laws does apply? Is it really illegal to share this in the whole world? Im not so sure about that.
Most western countries agree that the concept of ‘intellectual property’ is a good thing and afford protection, or else society disincentivizes innovation due to game theoretic tragedy of the commons-type reasons.
Earlier quoted context omitted.
You don’t actually need to listen to auditors. People like you (who can’t be bothered to argue because it’s apparently too hard) is the reason that smartass is still selling their services.
I was on the receiving end of a security audit issue. I closed the bug s won't fix, my lead approved it, but when the team who paid the security auditor found out they demanded I fix it. I had to argue with it, infosec, and the auditor. Nobody really cares what I did, they just wanted to follow the rules. After a month of weekly hour long meetings I relented and changed the code. You're often not arguing with the aud…
Earlier quoted context omitted.
Right but if you just download without seeding, no crime is being committed, yes? So seems like the barest you can do is "disable seeding", not "use a VPN".
Depends heavily on the jurisdiction, I am afraid. This exact case was used as a precedent where I'm from (Czech Republic) that no, merely downloading over BitTorrent still constitutes "sharing copyrighted material".