I am not seeing the long term, what is the value of this over a Shodan API key? They both crawl public IPs and explore subdomains for exposed resources.
Short term, if you have limited the view to companies only with bug bounty programs, it seems useful if you want to complete a bug bounty but don't know where to start. But the mapping of public resources has already been done.
I think showing URLs with sensitive params exposed, services using default creds, or some extra value add over a commodity scanner would be valuable. But then you would just be running a bug bounty/ pentesting AI service for bigger enterprises.
You can set this with Windows' default firewall. Setting to strict mode with
no whitelist causes a UAC alert every time a process attempts communication.
It is a deliberate oversight, the author picked metrics and test based on the result not the other way around. Even the first test (# of jobs per location) should be adjusted to jobs per population or something else since most people value diversity in their social circles.
This is the inverse of accurate, uBlock Origin already has a MV3 extension in progress (beta at https://ublockorigin.com/ top middle of the page). As others have noted, uBO is not even named in the Google releases, this applies to all MV2 extensions.
Annoyed they are barrelling ahead with this still, but not an attack on uBO or ad-blockers directly. Seems like they even made some changes to service workers to enable ad-blockers as well.
Perhaps gorhill will weigh in with more comments if he sees this. Curious if any of their changes to MV3 actually moved the needle on the issues previously identified.
I am not sure the ideal solution here. I do not like data caps in theory or practice, but I can see the CSPs thinking here: get paid for network usage somehow.
It just seems absurd since they are monetizing every part they can (insert capitalism is to drive revenue to shareholders rant here) that is wholly owned by each customer. VMs, IPs, disks, and databases are easy enough to say who owns what. But after that, the networking should be a shared service that is amortized by other product billables.
There is no real incremental cost to sending data in/out of CSPs so this feels like pure profiteering. They need networking for stuff to work, the fiber is already there, and they are billing for network resources. It is getting blood from a stone and reducing ability to flea, errrrm, migrate.
Maybe we return to the old days of mobile service and texting schemes. Free data ingress/egress on nights and weekends (or whenever traffic is less).
This looks incredible with the local search and context awareness. Curious if there is a comparison to other tools like photoprism about the advantages of Immich
As a internal security person (now a consultant for third parties): your approach is interesting, but still fails where all security tools do, who is going to install the agent on every box. The reason why every asset tracking solution is incomplete is because they are trying to correlate agent data and platform data. This is exacerbated by cloud computing since resources are much more transient and new servers lack gating by a governance org.
Complex AV tools are cool but they are so far down the chain of actually exploited vulns, they are not super useful most of the time. Usually the vulns used are old and just unpatched (check the latest DBIR data to see average age of exploited vuln). So a lot of time and effort goes into cajoling teams to update packages and having them say "we don't even call the vulnerable function."
My biggest issues:
-Asset inventory (SANS Top 20 #1)
-Software inventory (SANS Top 20 #2)
-Tagging of ownership (what does this box do and who do I call if it goes bump in the night)
To answer your other questions:
-Yes, but that is because we created it
-Yes, but only because we have tooling to do it across cloud envs
-No, we only look at deployed bins
-Signature based
-Getting useful code deployed to a box is hard enough, unless there a RCE this is so far down the list of threats on our threat model
-No idea, I assume pretty good since we use MITRE references, but making sure those are accurate to what we find is tough
>The only possible purpose of making laws like this is so that the state can try to enforce some remedy whereby we're told how much we have to or are allowed to pay someone. Who in their right mind wants to sign up for that kind of risk?
How is this the logical conclusion you arrive at? Do you as a company not have a salary range for headcount? Do you not expect prices to be posted by your vendors leading to a lack in informational symmetry and haggling during every routine interaction?
Imagine if your landlord could arbitrarily raise your rent an untold amount with no notice. You of course have options, move or negotiate. But the informational asymmetry means it is harder for you to know if you are getting a good deal if every other landlord is listing their rent as $1-100000 per month or not telling you until after you spent the time checking out the property only to find it is way outside your budget.
The time cost of candidates finding your job, doing some basic research, prepping for X rounds of interviews, possible homework, dealing with hiring managers/ recruiters is insane once you figure folks usually apply to multiple jobs. Why not just tell them up front the salary like you do for role expectations and company culture drivel? Posting honest salary bands is fine to me, say seniors will get $100-150k or whatever, but the article shows clear malice towards any legitimate transparency up front.
> during the GPU shortage where gamers who build systems with AMD chips were left unable to use their PC
This comment baffles me, both AMD and Intel have CPUs with onboard graphics and those without. You even noted the integrated graphics a sentence later.
If anything, this is more evidence that AMD is following the Intel playbook by having that integrated CPU/ GPU architecture plan.
I think the flip flopping is hurting them and their users more and more. What was initially a flat denial this morning has resulted in taunts from Lapsus$ on Twitter, Okta was out-scooped by Cloudflare's public investigation. Now they admit a breach affecting 2.5% (roughly 250 orgs based on public data).
The webinar tomorrow should be fascinating if they allow questions.
This is an incredible project I had never even heard of before. This is what github/lab projects should be in my opinion. An incredible solution, well documented, with exceptional examples. I got the intent and was up and running in less than an hour. Great functionality as well in terms of simplifying layout and portability.
Have you tired the Logitech K480? It met all my needs for pairing to my phone and an Android tablet with a nifty rotary switch for changing inputs easily. They keycap shape was lackluster but overall it was a novel solution.
I do appreciate the fine and the fact that the city will stop tracking citizens but I have to play devil's advocate: is this actually a privacy risk?
I have been playing around with passive wifi tracking for a personal project and found that most devices (including iOS and recent Android) all have MAC randomization turned on. Even in mesh wifi like this, the MAC rotates when a new base station is picked up. So while annoying and against GDPR rules, I am not sure if this is a true loss of privacy.
I cannot (maybe I can) think of how Activision thought this was a good idea. But it seems they will probably get their way since they have more money/lawyers behind them, sadly.
No, freedom of speech is about the government censoring your ability of speech. You are free to stand on a street corner and yell to the world but it does not require anyone to listen to you.
This person is advocating for a non-governmental website that is for enabling free speech since they see some voices as being silenced. But with that comes the ability for people you disagree with the speak as well. No government censored Parler, it was people who disagreed. What if this new service is overrun with people who disagree, will it be swept away in shadow posts or will people who say disagreeable things actually see that.
This begs the question, which is the default: light or full. You cannot claim to support freedom of speech and have this capacity in my opinion. It is implicitly saying some voices are less valid.
It is an interesting project technically, but I do not think it will replace the *chan model for edgy people to be edgy on the internet. If your opinions are so extreme that you feel that you must be anonymous and free from repercussions, they may be terrible opinions in the eyes of society.
Don't we have a marketplace already? If we take the game example we have Steam, Origin, Epic, and other stores competing to sell games. There are differences in offerings but they all still do a healthy business.
On the streaming video side it is even harder since we never license or pay for videos, just the ability to watch as long as the service persists.
Short term, if you have limited the view to companies only with bug bounty programs, it seems useful if you want to complete a bug bounty but don't know where to start. But the mapping of public resources has already been done.
I think showing URLs with sensitive params exposed, services using default creds, or some extra value add over a commodity scanner would be valuable. But then you would just be running a bug bounty/ pentesting AI service for bigger enterprises.