salsakran

5 ms·

1.
by salsakran 4mo ago
Stated differently -- the way OSS software is currently maintained and users are conditioned to behave, there is a capacity problem if the rate of discovery surges too sharply. And if the capacity is overshot (which I believe is happening a
2.
by salsakran 4mo ago
Yeah ... this gets into the question of what exactly an OSS creator's responsibility is towards users that don't pay them. In theory, nothing. In practice, it's in our long term interest that bad things don't happen to t
3.
by salsakran 4mo ago
Thankfully we've historically had a fair amount of attention (and investment in our security) by both customers, our oss users and people our ecosystem. The interesting thing is that the business model seems to have changed. Why collec
4.
by salsakran 4mo ago
In theory, the vulnerability was always there, and it's better to find out than not find out. In practice, how much effort it is to find vulnerabilities matters a lot. We're in a time where things that used to be quite hard are no
5.
by salsakran 4mo ago
I dunno man ... I produced a few things that got a few github stars over the years. At the risk of repeating myself -- this is targeted at other OSS maintainers, not random people who might have done a git pull of some random project a coup
6.
by salsakran 4mo ago
If you're using unmaintained OSS projects in this day and age, I'm sorry to say you might deserve what happens next.
7.
by salsakran 4mo ago
Perhaps -- but I think for most people, the vast majority of proprietary software they consume is over the network. But yeah, if you're distributing binaries publicly, then you're going to have very similar problems.
8.
by salsakran 4mo ago
With all respect to the Anthropic folks, that's just marketing. (If they're reading this: let us into the program so I can be proven wrong here.) I'm sure what they have is awesome, but it's clear that there are people o
9.
by salsakran 4mo ago
That line was aimed at other OSS maintainers. These alerts are absolutely not being shared publicly before we have a fix for them.
10.
by salsakran 4mo ago
Side conversation -- This is all stuff we're seeing in white/grey hat land. What's going on in blackhat land?
11.
by salsakran 4mo ago
That was true last year -- things changes. Ignore (admittedly low-effort LLM generated) reports at your own peril.
12.
by salsakran 4mo ago
I'm not sure that the benefit of many eyes helps here. So much of this bulk scanning is low-effort, and if you're a smart person developing closed source software you get the benefits of bulk scanning, but _at the time of your cho
13.
Welcome to the Strip Mining Era of OSS Security(metabase.com)
132 points by salsakran 4mo ago|90 comments
14.
by salsakran 3y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
15.
by salsakran 3y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
16.
by salsakran 3y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
17.
by salsakran 4y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
18.
by salsakran 4y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
19.
by salsakran 4y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
20.
by salsakran 4y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
21.
by salsakran 4y ago
Metabase | https://metabase.com | REMOTE | Full-time | All Roles We’re hiring for multiple positions across the team. Metabase is open source analytics software that makes it easy to ask questions of your data. It works with mos
22.
by salsakran 4y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers Metabase is open source analytics software that lets anyone in your company rummage around in the databases you have. It
23.
by salsakran 4y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers We're hiring for multiple positions across the Engineering team (and in many other non-engineering roles). Metabase
24.
by salsakran 5y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers We're hiring for multiple positions across the Engineering team (and in many other non-engineering roles). Metabase
25.
by salsakran 5y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers We're hiring for multiple positions across the team. Metabase is open source analytics software that makes it easy t
26.
by salsakran 5y ago
Metabase | https://metabase.com | REMOTE | Full-time | All Roles We're hiring for multiple positions across the team. Metabase is open source analytics software that makes it easy to ask questions of your data. It works wit
27.
by salsakran 5y ago
Metabase | https://metabase.com | REMOTE | Full-time | All Roles We're hiring for multiple positions across the team. Metabase is open source analytics software that makes it easy to ask questions of your data. It works wit
28.
by salsakran 5y ago
Good catch. I'll make sure it's public
29.
by salsakran 5y ago
Metabase | https://metabase.com | REMOTE | Full-time | All Roles We're hiring for multiple positions across the team. Metabase is open source analytics software that makes it easy to ask questions of your data. It works wit
30.
by salsakran 5y ago
Metabase | https://metabase.com | REMOTE | Full-time | Backend, Frontend, Full Stack, and DevOps engineers We're hiring for multiple positions across the team. Metabase is open source analytics software that makes it easy t

More ›