Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)X

xylogx

@ xylogx @lemmy.world

Posts
1
Comments
221
Joined
3 yr. ago

  • What advice/solutions did your therapy actually give you?

    Jump

  • Learned to recognize and preempt shame spirals before they dragged me down into depression. Made a world of difference.

  • Can we see a photo you took recently?

    Jump

  • A patch of Daffodils on the median

  • Microsoft alternative: Nextcloud and Ionos develop open-source ‘Euro-Office’

    Jump

  • Interesting, it is a fork of Onlyoffice.

  • Soup

    Jump

  • I laughed way too much at this. What is the source?

  • Deleted

    Permanently Deleted

    Jump

  • Intel Demos Chip To Compute With Encrypted Data

    Jump

  • Homomorphic encryption is pretty wild, you can sort and search data without decrypting it.

  • Removed

    How does Onlyfans models earn thousands and in some cases millions per month, meanwhile a lot of opensource developers earn less than 1000$ per month?

    Jump

  • The clear answer is that developers should have their own Onlyfans channels.

  • Tangled electric pole in Laos turns turns into 'scenic spot' on Google Maps, receives multiple 5-star ratings

    Jump

  • This is everywhere in Laos, not just one spot.

  • (Roughly) how old are you and how did you come to be on Lemmy?

    Jump

  • Peak Gen X, same

  • Deleted

    Permanently Deleted

    Jump

  • How excited I am about buying a new frying pan.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Take a look at Shai Hulud. All the attacker had was the key.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • I would feel more comfortable running curl bash from a trusted provider than doing apt get from an unknown software repo. What you are trying to do is establish trust in your supply chain, the delivery vehicle is less important.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • What you said is the key infra needs to get compromise. I do not need to own the PKI that issued the certs, I just need the private key of the signer. And again, this is something that happens. A lot. A software publisher gets owned, then their account is used to distribute malware.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Not sure how else to explain this. Look at the CISA bulletin on Shai-Hulud the attacker published valid and signed binaries that were installed by hundreds of users.

    "CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.[i]

    After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[ii]

    The malware then:

    • Exfiltrated the harvested credentials to an endpoint controlled by the actor.
    • Uploaded the credentials to a public repository named Shai-Hulud via the GitHub/user/repos API.
    • Leveraged an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry.[iii]"

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • If I can control your infra I can alter what is a valid signature. It has happened. It will happen again. Digital signatures are not sufficient by themselves to prevent supply chain risks. Depending on your threat model, you need to assume advanced adversaries will seek to gain a foothold in your environment by attacking your software supplier. in these types of attacks threat actors can and will take control over the distribution mechanisms deploying trojaned backdoors as part of legitimately signed updates. It is a complex problem and I highly encourage you to read the NIST guidance to understand just how deep the rabbit hole goes.

    Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Signatures do not help if your distribution infra gets compromised. See Solarwinds and the more recent node.js incidents.

  • A sneaky demonstration of the dangers of curl bash

    Jump

  • Yes this has risks. At the same time anytime you run any piece of software you are facing the same risks, especially if that software is updated from the internet. Take a look at the NIST docs in software supply chain risks.

  • Vibe Coding Has a Security Problem Nobody Wants to Talk About

    Jump

  • As a security professional it amuses me that you think non-AI generated code is manually reviewed for security. Either you are committed to code quality or you are not. If you are you have automated testing, standard architectural patterns and vulnerability scanning. Peer reviews are great but do not scale and are far from comprehensive.

  • How do you know youre getting burnt out at work?

    Jump

  • One red flag for me us too much multitasking. If I have too many things I am working on and none of them are getting completed eventually switching between tasks becomes so disruptive I cease to make any progress on anything. I fight this with focus and prioritization: find the things that are most important and focus on them until closure.