photon12

Because in both auth and email one can make a small screw-up that allows for a company threatening breach. As someone who has performed penetration tests for all of: companies that roll their own SSO, companies that use a third party SSO service, companies that provide third party SSO services, the failure modes for contracting out to a third party are a bit easier to manage if you are a small company, and chances are if your SSO provider is breached they are going to care about bigger fish than you.

For medium to large enterprises, the calculus is harder and there's going to be months of flame war trying to hash that out.

It's worth noting we don't know what the true motive of any group that claims to be solely about ransomware and extortion actually is.

There have been some headlines about what you reference but I'm skeptical that work has amounted to anything lasting.

If you are operating from a jurisdiction that's already under heavy sanctions or severed diplomatic relations and extradition is unlikely, the laws of another country don't really matter.

Seems a bit premature to assume this was the vector used for those other breaches.

There's a reason I'll only ever run NPM in a VM on any machine that has any data I care about

I do enough hardware security work to where I wouldn't want anything like this anywhere near the motor or sensory or emotional functions of me or my loved ones anyway. One abusive partner or associate could do so much damage.

Don't want to even feel a bit of pressure from people who say I need this kind of tech to "stay competitive in the marketplace."

My initial bias as a potential customer is that I really don't like this stuff. And it seems like the leadership chain in this particular product isn't doing anything to assuage my concerns or show seriousness about minimizing harm. This is self-defeating product strategy at best.

At worst...well others have said it better.

Here's a video of what an exploit of this kind looks like. You are correct it requires accepting prompts: https://youtu.be/E7y_UCshcCM

The Qubes clipboard model is one of the reasons I use that OS: https://www.qubes-os.org/doc/how-to-copy-and-paste-text/

I worked in a role at Amazon that required me to interact with a different team every 1-3 weeks. I would often sit directly with the teams as I was doing work with them for the duration.

There are teams at Amazon full of some of the best technical and professional managers on the planet. There are teams at Amazon that are so brutally driven that they will sacrifice anything, even accepting an incomplete pentest audit and a forgoing week's worth of sleep, to hit a launch date.

I personally had a close friend on my team get PIPed and it was obviously a play from management to get rid of him. I have another friend who had to take months off after leaving because of the abuse she experienced. I have other close friends who have stayed for years.

It's such a big organization and the leadership chains are so decentralized that you get a wide variety of emergent patterns, and the decentralization makes it hard for people across the organization to know about the experiences of other teams.

Edit: in general I wouldn't say the horror stories are the norm at all from what I've seen.

Amazing what started with Heroku* has turned into.

*Started for me at least. Heroku was how I got started as a Rails developer, and it made it so easy to get a deployment available to interact with from anywhere.

Here's a series of tweets by @SwiftOnSecurity to give a feeling of how those really impacted are doing that I think capture the mood:

https://twitter.com/SwiftOnSecurity/status/14694518560910090...

https://twitter.com/SwiftOnSecurity/status/14703213781550202...

https://twitter.com/SwiftOnSecurity/status/14703215750145802...

https://twitter.com/SwiftOnSecurity/status/14704312736342179...

https://twitter.com/SwiftOnSecurity/status/14707958604349030...

History and Class Consciousness, György Lukács

I got it at a bookstore one day because the shelf note on it from one of the staff members made it seem interesting, didn't really know what I was getting into.

Apparently I had bought a book full of real Bolshevik philosophy essays from a Hungarian "Orthodox Marxist" philosopher, like what Zero to One would be in the USSR.

It was written in the 1920s before the whole Soviet project imploded, and what was fascinating about it for me was how precise it tried to be about the nature of how human processes and how they change. In hindsight, we know that the Soviet vision was bound by a ton of contradictions, but this book was like an inside view of a part of history I didn't really know much about, and kinda made me realize how easy it is to find some new wrinkle to history you had never considered before. Got me reading a lot more interesting histories of places.

Here's an excerpt from the book, the whole thing and all the essays are actually free online. On "Orthodox Marxism" (something I didn't even know could be classified that way lol)

https://www.marxists.org/archive/lukacs/works/history/orthod...

Credit card data is relatively small cardinality and easy to predict the form of.

Medical data is... not that

FYI, here's the link

https://www.symbolcrash.com/podcast/interview-with-josh-pitt...

They don't

There's a lot of bad advice on secret storage that is Not Based On A Threat Model™

Yep, planning on editing it tomorrow

It's with Josh Pitts, author of this tool [1] and another payload that caused lots of go projects to be eaten by Kaspersky [2]

[1] https://github.com/secretsquirrel/the-backdoor-factory

[2] https://github.com/golang/go/issues/16292

I mean the same company built a service with better architecture that they sell as part of their managed computing environment options.

Some people complain about not wanting to use it due to "lock-in."

Interviewed someone last night for my podcast who has written some python malware tools, and there's enough stuff out there to where you can't exactly call it a new concept.

Like HAM radio, there is an incredible amount of metadata that is necessarily public.

(Seriously, any use case for which Bitcoin is a privacy solution puts Bitcoin up against strictly superior implementations of decentralized BFT value exchange protocols which I will not list as to not come across as a shill but are all things you have probably heard of).

It's a large company that built their own bespoke internal credentials service running over a TCP port to the application with another proprietary protocol to push key material to hosts.

Can't say much more due to NDAs.

Edit: this service handles credentials and rotation for hundreds of thousands to millions of hosts.

Fair point.

Though I feel like in any modern app deployment scenario that isn't going to be a meaningful defensible boundary.

The answer is to use neither, especially given the number of times I've used a path traversal vulnerability to expose /proc/self/environ on a pentest, and the one time I was frustrated on a pentest when every app in the environment used a dedicated API for secret retrieval and the path traversal vulnerability I had access to was worthless.

Aren't these equivalent, given that the /proc/x/environ file exists?

Also this pattern makes path traversal vulnerabilities (a thing not uncommon in web frameworks) have the potential to allow for privilege escalation on Linux via the /proc/self/environ file.

I've been on a pentest where a recently disclosed path traversal bug in Rails was not patched in the environment I was testing and I thought I would get at least some credentials from at least one service, but every host used a dedicated API for secret retrieval and there was nothing sensitive exposed via any system.

Maybe your threat model doesn't care, just adding a data point.

You might be thinking of the Surveillance Saver.

I have a buddy who did a revival a few years back, don't know how bit rotted it is but here's a link:

https://www.awgh.org/archives/295

I feel like the idea that society has accepted software bugs for some other benefit is questionable, given that software has only had an impact on most people's lives for a relatively small period of time in relation to the amount of time humans have studied philosophy and ethics.

Edit: also I'm discussing security bugs where there are asymmetries in the risk profiles and threat models of actors and agents.

This is also true for software production: we have made writing and deploying software so easy to do that the rate at which training of software developers to produce PRs has outpaced the ability for systems either human or automated to handle managing the introduction of risk in all this new code.

This talk [1] by by Mark Sherman of the Software Engineering Institute at CMU is about as dark as the summary of injuries Tim presents in his post. He mentions there are on the order of hundreds of thousands of CVE reports that there are neither time nor money to triage.

[1] https://www.platformsecuritysummit.com/2019/speaker/sherman/

The thing is the kernel is kinda hurting for maintainers and opening up the path for the next generation of systems programmers (most of whom don't want to touch C any more than they have to) has to be something Linus is more likely to prioritize than in previous decades.

I imagine that's a more tractable problem to solve but as it stands this is definitely the bigger issue.

Reading through the FAQ, looks like the kernel can run on 1 physical core and SMT/hyperthreading isn't enabled (maybe that's changed).

Seems cute but the WSL has the full support of the Windows scheduler which is gonna make the practical choice of tool obvious for folks with Linux workload requirements.