Avoision*
And that is going to have to change. There are already plenty of methods that are low-impact to users, like certificate-pinning in apps, and all you have to do to make it per-user is roll in their user-specific key JIT…
Almost no companies farm their security out to third parties. The era of MSSPs is long dead, except for small non-IT businesses like mom-and-pop law firms. > Most orgs need to expose a lot more than that. No, in fact…
1. That's fair, I didn't realize people were expecting my comment to be perfectly-aligned to every aspect of the thread parent, including the "their own hardware" part, but now I at least see where the confusion came…
1) where did you get "on-prem" from? 2) that's not what "rolling your own" means. Building your own web proxy is "rolling your own". Standing up e.g. Caddy and configuring it is not.
Ideally they need to divide those apps entirely; your public website doesn't need to talk to your app. For stuff like Netflix that is truly consumer-facing, where mTLS or IP whitelisting are non-starters, the reality is…
You're still describing an environment that presents a pre-auth surface area beyond a listening port. And I am literally a security engineer; the work has absolutely not gotten harder, it's just changing in how you…
Why would you roll your own?
You joke, but the space I work in actually does do video calls (or in-person meetings if they're local to SF, often) before onboarding new customers.
An exploit in what, the network stack of the Linux distro you're using for the mTLS proxy? Or the crypto module? Sure, could happen. But then, you're unlikely to be the top target of anything. Or do you mean a customer…
No self-service sign up for your app. No public access to the app itself. Website that let's you submit a sign up request form. Team reaches out and reviews your request, creates an account in the app dash for you, and…
You don't have to ship a dependency for it to be a vulnerability; the shai hulud worm was attacking dev machines and cicd environments to steal credentials. The deps you run are absolutely just as critical.
Who knew it's possible to simply have perfect vuln-free code! We security engineers are definitely shaking in our boots.
> When people install npm packages, they typically only install ones the community trusts. This is wishful thinking. Devs add in dependencies to do mundane stuff all the time, regardless of provenance. As others pointed…
Beyond ongoing support, community/number of contributors doesn't indicate anything, though? And maintainability is a function of code, as it relates to humans, so it is a measure of the code itself.
That is great, but the reality is that your OS, the productivity software you use daily, and the dependencies downstream of the ones you review, are not actually being checked by you for code quality. Part of using…
"I don't trust code that I don't understand, or that I don't know someone experienced has reviewed." proceeds to install 200 random npm dependencies
Yeah, all these devs pretending you can only trust code you understand, then going and pulling in 1000 random npm deps...
This response fails to deal with what I explicitly called out: actual evidence that the outcome is not accidental. And it also fails to address that if a system is continually failing to achieve an acceptable outcome,…
Don't know why you think I don't understand that, I'm just pointing out that a law being a law doesn't shield racist people who support racist laws from being called racist.
Sure, but when 1 party blocks that continually due to racism (and kills programs put in place like DACA that help the situation), then funnels money to "law enforcement" specifically for the thing they helped make…
That response article (whether intentional or not, I can't say) horribly misunderstands and misrepresents the POSIWID axiom. It's not about the outcomes of something taken in isolation, it's about the actions taken in…
Tons of those are (as the site admins admit) models that are themselves infringing on copyright, and thus any license based on copyright ownership is invalid. You can't enforce a license on a 3d model you in turn stole…
If you read the article, you'd know that he is mainly talking about the Win-XP and earlier era. There is a gap there of the 'golden years' of e.g. Win 7 and 10, before the LLMs but after Windows (Loboto)ME. And computer…
> Are people allowed to not want islam big in their home town? Well Islam isn't a popular grocery store chain or something, so what you're really asking is, > Are people allowed to not want Muslim people in their home…
Avoision*
And that is going to have to change. There are already plenty of methods that are low-impact to users, like certificate-pinning in apps, and all you have to do to make it per-user is roll in their user-specific key JIT…
Almost no companies farm their security out to third parties. The era of MSSPs is long dead, except for small non-IT businesses like mom-and-pop law firms. > Most orgs need to expose a lot more than that. No, in fact…
1. That's fair, I didn't realize people were expecting my comment to be perfectly-aligned to every aspect of the thread parent, including the "their own hardware" part, but now I at least see where the confusion came…
1) where did you get "on-prem" from? 2) that's not what "rolling your own" means. Building your own web proxy is "rolling your own". Standing up e.g. Caddy and configuring it is not.
Ideally they need to divide those apps entirely; your public website doesn't need to talk to your app. For stuff like Netflix that is truly consumer-facing, where mTLS or IP whitelisting are non-starters, the reality is…
You're still describing an environment that presents a pre-auth surface area beyond a listening port. And I am literally a security engineer; the work has absolutely not gotten harder, it's just changing in how you…
Why would you roll your own?
You joke, but the space I work in actually does do video calls (or in-person meetings if they're local to SF, often) before onboarding new customers.
An exploit in what, the network stack of the Linux distro you're using for the mTLS proxy? Or the crypto module? Sure, could happen. But then, you're unlikely to be the top target of anything. Or do you mean a customer…
No self-service sign up for your app. No public access to the app itself. Website that let's you submit a sign up request form. Team reaches out and reviews your request, creates an account in the app dash for you, and…
You don't have to ship a dependency for it to be a vulnerability; the shai hulud worm was attacking dev machines and cicd environments to steal credentials. The deps you run are absolutely just as critical.
Who knew it's possible to simply have perfect vuln-free code! We security engineers are definitely shaking in our boots.
> When people install npm packages, they typically only install ones the community trusts. This is wishful thinking. Devs add in dependencies to do mundane stuff all the time, regardless of provenance. As others pointed…
Beyond ongoing support, community/number of contributors doesn't indicate anything, though? And maintainability is a function of code, as it relates to humans, so it is a measure of the code itself.
That is great, but the reality is that your OS, the productivity software you use daily, and the dependencies downstream of the ones you review, are not actually being checked by you for code quality. Part of using…
"I don't trust code that I don't understand, or that I don't know someone experienced has reviewed." proceeds to install 200 random npm dependencies
Yeah, all these devs pretending you can only trust code you understand, then going and pulling in 1000 random npm deps...
This response fails to deal with what I explicitly called out: actual evidence that the outcome is not accidental. And it also fails to address that if a system is continually failing to achieve an acceptable outcome,…
Don't know why you think I don't understand that, I'm just pointing out that a law being a law doesn't shield racist people who support racist laws from being called racist.
Sure, but when 1 party blocks that continually due to racism (and kills programs put in place like DACA that help the situation), then funnels money to "law enforcement" specifically for the thing they helped make…
That response article (whether intentional or not, I can't say) horribly misunderstands and misrepresents the POSIWID axiom. It's not about the outcomes of something taken in isolation, it's about the actions taken in…
Tons of those are (as the site admins admit) models that are themselves infringing on copyright, and thus any license based on copyright ownership is invalid. You can't enforce a license on a 3d model you in turn stole…
If you read the article, you'd know that he is mainly talking about the Win-XP and earlier era. There is a gap there of the 'golden years' of e.g. Win 7 and 10, before the LLMs but after Windows (Loboto)ME. And computer…
> Are people allowed to not want islam big in their home town? Well Islam isn't a popular grocery store chain or something, so what you're really asking is, > Are people allowed to not want Muslim people in their home…