sullivanmatt

I have no idea how you could shrink this down to fit on any type of prosumer hardware though. I doubt it's possible.

You can argue about whether the "publicly announced existed" part since they don't advertise for any single package, but that's the ecosystem you buy into.

Also if you don't like organizations fixing vulns without releasing the open source first, you're going to be upset when you learn how every major vuln and associated patches are distributed long before the fixes hit the repos. A timely example of this is PHP, literally today.

1) Schools were closed from Covid for a long time. Not here to debate whether that was good/bad/otherwise, but it is factually accurate to say Oregon schools remained remote longer than almost any others in the country, and we now know the duration of closure had pretty direct influence on learning outcomes.

2) In the past decade the Portland metro area has seen an influx of migration from economically disadvantaged families who are immigrants / first generation citizens / non-native English speakers in the home. Students from these families are lagging significantly behind their peers in terms of post-Covid recovery, which if I recall correctly, follows national trends as well.

In December 2024 the page had been updated to now compare "dbt Core" against "SDF with dbt": https://web.archive.org/web/20241217172451/https://www.sdf.c...

Little marketing switcharoo there to avoid pissing off their future owners.

This is a little tangential but another good piece of advice is to avoid over optimization of the engineering stack. A giant monolith running on the largest RDS instance AWS provides a lot more runway than people realize.

But yes, your point stands. Huge number of preconditions here to fulfill.

To be clear, the "remote" part of the code execution is that an attacker controlling your destination server can cause your client to run an attacker-controlled payload, if the client is forwarding their credentials (`ssh -A`). Most people don't tend to make connections to arbitrary SSH hosts, and certainly they don't do it while forwarding their credentials along.

It's a neat attack, and I applaud the Qualys team on their find, but this is not any sort of emergency situation for 99.99% of systems.

Debian (and by extension, Ubuntu) chooses to not fix a significant amount of security issues. This makes sense given their business models, but is an unworkable position for a huge number of enterprises that depend on Linux. Example: https://ubuntu.com/security/CVE-2021-45464

I'm working on a side project to basically make the tool I wish existed: https://integralcloud.io

If you have a use case that you are willing to talk to me about, please reach out (contact info on my profile). I won't try to sell you anything, ever. I just want to hear about business use cases and try and make something people want to use.

https://integralcloud.io is the app.

The challenge with on-prem software of course is just how much support it takes to maintain. At my last gig, we deployed new microservices every 5 minutes; I can't imagine how much it would have sucked to worry about maintaining on-prem installs.

I'm wondering if this kind of shared model could make it workable.

Now I live on an ELK stack and I experience nothing but full-time agony as I switch between Kibana and Kibana Lens constantly. It's clear they are two completely separate "products" built for different use-cases. The experience reminds you constantly that they were not purpose-built for how I use them, unlike Splunk.

Increasingly we are moving towards the reality of a security data lake, and all I can think is that I'm about to lose what little power I had left as I have to move to something like Mode, Sisense, or Tableau which again, were not purpose-built for these use-cases and even further separate the query/data discovery and visualization layers.

I hate how crufty and slow Splunk has gotten as an organization, and they use their accomplishments from 15 years ago to justify the exorbitant price they charge. I really hope the OSS/next-gen SaaS options can fill this need and security data lake becomes a reality. But for that to happen, more focus is needed on the user experience as well.

Regardless, very cool stuff and could definitely fill a need for organizations that are just starting to dip toes into security data lakes. I wish you success!

If anyone thinks these communications are a smoking gun, I'd invite them to get into the upper reaches of leadership and see for themselves that there are rarely cut and dry cases where everyone agrees on what to do or when to do it. In reality, operating a multinational business that needs to avoid regulatory scrutiny is, believe it or not, challenging.

So look at all this through the lens of what Elon seeks to gain from releasing all of this. He never acts out of pure altruistic intentions; he only takes action when he believes it will greatly benefit him.

That's the value prop.

https://trademarks.justia.com/owners/zamora-jorge-3828689/