cws

Link words for more points. New puzzle every day.

This article says “Book Review:” but then doesn’t provide the title of a book. I’m confused.

:)

This is my experience as well. A solutions architect is likely to be working directly with customers to achieve what they want with the product which can involve deployment work, integration work, etc. Sometimes this work is found to be repeatable across customers and may be engineered into the product. An architect (in a software or IT context) can have pretty widely varying responsibilities, usually more focused on building product or internal company environments. But solution architects have been fairly consistent in scope of responsibility across the companies I’ve been exposed to

I really thought it was going to be something about a “Y axis” or “Y Axes”

This is about CVE-2022-22965. Maybe I’ll edit the title to reflect that.

Depends a lot on how many Spring apps out there have the prereqs to be vulnerable. The widespread nature of Log4Shell is what made it “worse” than other RCE vulns. I don’t have a sense of how many vulnerable instances of this one might be out there but the number could be enormous.

What made it seem that way? I feel like the post provides a solid answer to the question asked in the title. Does it not?

OP here. Sorry that it felt that way to you, and curious why? Because it is from a corporate blog? The material answers the question posited in the title, IMO, but curious why it came off as an Ad to you. Mind sharing?

As of this writing, the fake Postman extension appears to have been removed from the Chrome extension store. Huzzah!

I just searched for the fake Postman extension again and it appears to have been removed. Hurray!

Yeah, that is incredibly frustrating. It seems to me that many of these types of scams target general consumers, piggybacking on legitimate app's names to get a few thousand people to pay a buck or give you some personal info, etc. These instances that target developer tools have the potential to do a different kind of damage to peoples' livelihoods.

Totally. This extension was trying to be stealthy about exfiltrating data...but it wasn’t trying that hard. As noted in the article, the same developer had at least one other extension using the same code to obfuscate and exfiltrate data. Seems like sort of a spray and pray approach

Yep that’s a great point. That deprecation probably contributed to the gap that the malware uploader exploited. People expect an extension called postman, and they find it. Their guard is down and they download the fake one. I don’t know the solution but there has to be a better way for App/extension stores to handle this relatively common scenario.

It was sending off URLs visited by the host machine. Browsing history, essentially, which could be benign except that when your machine is inside a corp network you might be visiting all kinds of internal resources with URLs that shouldn’t be public/with sensitive info included in the resource locator, GET/POST contents, etc

Here’s a ZDNet article about the same extension https://www.zdnet.com/article/industrial-espionage-fears-ari...

Yep. Pretty hard to police. Unlikely to be removed until it gets quite a lot of attention.

It is a network traffic analysis product. You send it traffic via port mirror and it analyzes for shady behavior. Here’s the main overview of what it is https://www.extrahop.com/products/security/

This approach will likely be most useful for large enterprises that get attacked, since they're more likely to have a buffered packet capture of network traffic. This is still incredibly powerful given that most ransomware-prevention mechanisms are completely useless once the ransomware is already in your system.

Fair enough. Preventing ransomware from getting all the way through is a worthy goal as well. The fewer files they can encrypt, the better. It's hard to stop individual users from download malware onto their own machines, but stopping that malware from moving laterally into network attached storage can mitigate a ton of damage.

The headline refers to a different narrative that comes in about the middle section of the post, where a ransomware attack on a separate healthcare org was successfully thwarted (and thereby didn't make it into any headlines)

Fair enough. It is a blog on a company website, and the topic of the blog is relevant to the product. Pretty standard in my eyes.

I would argue the "Message to Our Customers" from Apple that sat on top all day also had a fair bit of marketing spin in it. That didn't bother me, but opinions differ & I respect that.

Valid point. An out-of-band network tap is definitely a pretty insider-y term to the networking community. What it means is that there's a device sitting in a company's datacenter that can receive a copy of all the traffic flowing through that network without impacting the performance of said network.

Some performance management tools will use up some of the bandwidth of a network to be able to perform their duties. An out-of-band tap offers a way to get visibility into what's happening in your network so you can monitor performance without sapping bandwidth.

Good question. The statement was made by the Chief of Tailored Access Operations at the NSA, so that's some pretty high level brass.

I don't know the answer, but I'd guess it is something the brass is aware of and maybe frustrated by, and the devs have a nuanced view of the implications of it.

Good discussion of tinygrams, nagle delays, and the role restricted MTUs play in them on StackOverflow too: http://stackoverflow.com/questions/2421107/how-does-sending-...

Loved this post. So prescient.

I was exposed to Amdahl's law first through this blog post about how the concept can be leveraged for competitive advantage. Always love seeing how the technicals affect the biz side of things.

https://www.extrahop.com/blog/2013/20gbps-realtime-transacti...

I find digging into someone else's code incredibly intimidating and I like hearing about other people's approaches to this challenge. If anyone else has tools or processes they use to get oriented in a new codebase I'd love to get them in the comments.

ExtraHop Networks, Inc --Seattle, WA --ONSITE

We're the global leader in wire data analytics, a new approach to IT Operations Analytics(ITOA). We provide an invaluable platform for deriving actionable insight from the lifeblood of any IT Ops organization—its wire data. This is a growing team where everyone makes significant, measurable impact.

We're growing fast, and hiring for many roles, but I'll just call out two here:

Digital Marketing Analyst - If you live and breathe web analytics data and know how to leverage it to make great marketing decisions, check out the full Job Description and apply here: http://bit.ly/1BZ58ul

Technical Marketing Engineer - Got experience writing scripts and building and troubleshooting datacenter network environments using common operating systems and software packages? Know Python and Javascript? Comfortable writing and talking about all of this? Check out the full Job Description and apply here: http://bit.ly/1FRNvHO

We're hiring for plenty of roles, so if one of the above doesn't fit, see what else we have open: https://www.extrahop.com/careers/

I love working at ExtraHop. You will too.

the separation of content and presentation has been important in web design from a code perspective. CSS exists because separating content and presentation was desirable. But most people don't want to deal with all that mess. They want to make a fun web page quickly and easily to serve whatever purpose they have in mind right then.

Yeah. One thing scroll kit does really well is allows the screen to be filled with a single idea/image/composition. I haven't seen a lot of sites experiment with serving ads that way though.

I've said it before, but Scrollkit is what I always wanted Dreamweaver to be like. Maybe I had the wrong expectations of DW but I really think Scrollkit is going to help people who think they're hopeless online see that they can make good stuff too. They're lowering the barrier-to-entry for making a great looking page to almost nil.