LogJ4 Security Inquiry – Response Required

Post by notyourwork » Mon, Jan 24, 2022, 5:27 PM UTC

commandlinefan wrote: post #45

notyourwork wrote: post #23

I find it a bit sad that a tech literate group is bashing a non-literate group fo people. The entire reason your salary is much larger than many other career paths is because of your ability to deal with technology. The premise that when the less educated and informed try to question something they don't understand only to be left with pandering and jabs is disingenuous. The questions although perhaps better phrased…

I had the same thought - the e-mail really wasn't that unreasonable, coming from the perspective of somebody who didn't realize there was no support contract in place (and maybe didn't even understand how that could happen). Haxx's response seems similarly reasonable - we don't have a support contract, let's get one in place and then move forward from there. This really seems to be an object lesson that if you're dep…

Post by [deleted] » Mon, Jan 24, 2022, 5:29 PM UTC

BiteCode_dev wrote: post #6

It's actually fantastic to receive such email. You can answer: "We are happy to provide you with support regarding this issue for $5000/day" Then if they accept, proceed to do nothing for 10 days, then reply you find none of your code is impacted and they are safe then bill them $50k.

Post by matheusmoreira » Mon, Jan 24, 2022, 5:30 PM UTC

0x500x79 wrote: post #34

Many organizations document their 3rd party vendors and libraries and it doesn't surprise me that an automated email reached Daniel. Most likely someone mis-documented using one of Daniel's projects in a spreadsheet. I am personally a bit surprised about the responses here. It is completely reasonable for this email to reach Daniel and is most likely an artifact of bad documentation by engineers in the company. At th…

Post by devit » Mon, Jan 24, 2022, 5:39 PM UTC

Post by zerkten » Mon, Jan 24, 2022, 5:43 PM UTC

devadvance wrote: post #56

verytrivial wrote: post #22

For everyone boggling at the tone of the email, stop for a moment and have a guess at how many different sources of software they think the average large corp has on their books let alone on their infra. It can literally be hundreds or thousands of different sources. And each of those will have their own topology. This is clearly a scatter-gun survey because they're realised they really have no idea of their exposure…

Generally this is an accurate take. I'd add two things: > ...because they're realised they really have no idea of their exposure. This is partially because it is often non-engineers being asked to figure this out. The "information security analysts" at F500s are asked to do a lot of unfair work, such as analyze risks related to decades-old software they didn't build. > ...there's a whole business ecosystem in just be…