-15 karma · joined August 28, 2014
And yes this is a valid question whenever somebody considers to use OSS (or for prop. software, how likely chance will be an exploit will be found without source code at hand, and/ or how big of a hole it burns in your budget & wallet).
Can be reviewed doesn't mean has been reviewed. Nor does it imply any quality of review, or the quality of the reviewers itself.
And the knife cuts on two sides, though only one side is mentioned, the one side that should attract users. Not the side, that every evil minded person can look through the source code, abuse it, before we were able to counter/fix etc it.
I can't be the only one that sees a hypervisor (cloud host), virtual machine and docker containers, 3 layers for what? For ease of use?
So you have more infrastructure to monitor/keep updated etc for that same software/service which you used to run on the machine that is now the hypervisor/cloud host? For which again you need more resources, as even though the layers might be efficient, they still require resources.
Why would one want to keep old stuff around? With minor naming differences, creates room for a mistakes too. "oh wait no we should have started version 201401018 instead of 2014010218"
I don't see any benefit over physical machines with some proper thinking before upgrading, preparations.
Somethings i would have liked to have read/seen though are, the hardware specs, database dimensions (nr of entries in tables etc) and query times.
Just my penny. Hope you can spend it still somewhere :)
The scanner most likely does a simple version compare. The scanner assumes anything under version X.Y == vulnerable. If it would be hiding or faking the vendor and version to latest IIS (or apache, or nginx or etc), possible it would simply report all is A-Okay. Unless the scanner really test the actual exploit/vulnerabilities, i assume the simple version compare happens.
Though i'm quite certain the malware didn't get *there via a method that only utilises the webserver; more likely a poor coded (php, perl, etc) script allowed 3rd parties to download/write to disk of your webserver.
If for example shellshock wasn't patched in time, and there was a vulnerable cgi script or similar on the website/server, it could have been that script+bash, that has been exploited. But that doesn't make the webserver vulnerable. (even though the malicious upload/ action was executed via the webserver)
Still have boxes with apache 1.3 running, but all potential vulnerabilities are patched and or bad feature(s) removed.
Bottomline i think is, you are unhappy with your web host. Find another that does match your particular preference.
Plus that you are not making any third party aware of anything, as you don't need them. And might save you a lot of hassle in the middle of the night and you need vendor support, which generally at such hours could generate even more cost.
In my humble opinion, technical pov, the more you do in-house, and the less you rely on third parties, the more freedom the company has.
Also any in-house developed product, could be sold, generating income. Also, i believe, that developing your own, gives you a certain knowledge which you don't get if you are simply adopting third party software.
It's of course way easier/more clear to calculate ROI when you spending specific amounts instead of investing in knowledge, control and self power. The returns on that can very a lot.
But, generally speaking, things are only 'expensive' if you think they are not worth it.
I'm quite sure that for a lot, if not majority of the packages you pay for, there is a perfect open source, free to use alternatives. Which might require just as much time to integrate as it's paid alternative, but you will have full control, self hosted.
Also consider the impact of the information you are sharing with all these third parties. Might be a bigger concern then currently estimated.
Example, the dead man's snitch, it kind of leaks every time a cronjob runs/fails.
I don't see anybody making such a big fuss when people don't close the curtains in their home at night (or even during the day). Sure you can see who is peeking into your house, but technically is it much different then a insecure/unconfigured webcam?
500 Internal Server Error The server was unable to fulfill your request.
Not sure what to think of it, many people are broadcasting on purpose. I think more can be said about people looking at the cams then the ones that forget to locks things down, or on purpose leave things insecure.
-1 thank you.
Maybe they are all little socrates'es
Also people that care about their email, (should be/ are) willing to pay for it. Then again, people that care will most likely host their own.
Where do i mention the destructive force or ANYTHING negative about gay people? Oh wait i didn't. .. fools
If it does live long, i might start to wonder if this is some RIAA like honeypot system to have users report where they get their torrent downloads from by sharing the links directly.
Just my penny.
Application Error An error occurred in the application and your page could not be served. Please try again in a few moments.
If you are the application owner, check your logs for details.
'We want some attention for our article now, but do not shoot us if it turns out to be completely bogus. But if we were right, we want to be seen as awesome researchers, bringers of news etc'.
Then somebody managing to capture all my login details in different websites with a per website login in a particular time frame, they would need a year to capture all logins as i don't use all sites daily weekly, or even monthly.
One can discuss it short, one can discuss it long :) but you remain to put all your (generated) eggs in a single basket. A basket (computing security does not exist, it only delays things) that cannot be more secure then your mind.
Perhaps even lowers your security in ways.
Sharing the fact (with the internet) that you use a password manager, lowered your security already, technically speaking.
I find the idea to use one password (and a private key etc) to protect all my other accounts and passwords a bit strange, specially synced over 3rd party servers/services.
Not to mention when people use it on devices often discussed to have ways to eavesdrop on a user, android, iPhone. The security of the password vault is now equal to that of that particular device. (which could be as low as no security)