longtermsec

7 ms·

1.
by longtermsec 7y ago
bingo. one should always assume that userland access on a linux box is a short step away from full system privileges and active exploits are ready for use by an attacker. docker has started adding hardening with SELinux+Seccomp because ther
2.
by longtermsec 7y ago
I'm not sure that it is overly simplistic, I think the statement that "containers do not contain" is an intentional oxymoron that points to some ground truths. These ground truths are that a process in a container is running
3.
by longtermsec 7y ago
so a) and b) are common in practice. these were not obscure boundary conditions or a corner case. and it was very trivial to exploit. "all software has vulns" is a slippery slope is my overarching point. you can't use that
4.
by longtermsec 7y ago
The idea that it's trivial to break out of any Docker style container just doesn't reflect reality. -- not just being contrarian here, actually, the reality is that it might be trivial. and it was demonstratively trivial for a lon
5.
by longtermsec 8y ago
Yeah it's a tough space for sure. Given that this is a research project i'd hold off on making assumptions that the software has been adequately verified as well. Forgive the loose usage of Rumsfeld-like terminology here, verifica
6.
by longtermsec 8y ago
The money for the interest payments comes from taxes!
7.
by longtermsec 8y ago
TL;DR dividends dont get a tax deduction, interest from debt for buybacks do, so buybacks are more attractive Given that interest rates were so low from 2009-2017, many companies actually issued debt not because they needed the money but in
8.
by longtermsec 8y ago
Apps are one risk, but it's an opt-in risk. Telecom companies are also another risk, and much larger one in that, because there is no opt out of location sharing with them. Same with analytics on your telco network traffic.
9.
by longtermsec 9y ago
Keeping a log of visitors to your own computing resources is an ethical grey area since when? IP Addresses themselves are most useful for deanonymization/violating privacy when shared across organizations, or converted to accounts from
10.
by longtermsec 9y ago
Is this accurate? If that was the case then interest from savings accounts and CDs wouldn't be taxed at the marginal tax rate as ordinary income is.