Tell HN: Information security audit / consulting is largely a scam industry

Re:Tell HN: Information security audit / consulting is large... by icedchai on Sunday July 10, 2022 @10:02AM (#32044873)

I forget the specifics, but there was no way to exercise the module remotely. I think it was actually Apache, not nginx, and the module was not even loaded. It was one of those bullshit "medium priority" line items.

[ Parent | on HN ]

Re:Tell HN: Information security audit / consulting is large... by dizhn on Sunday July 10, 2022 @02:24PM (#32047394)

You are probably misremembering the story. If the module was really not enabled it wouldn't come up in a security scan or be present in the banner.

[ Parent | on HN ]

Re:Tell HN: Information security audit / consulting is large... by vladvasiliu on Sunday July 10, 2022 @03:17PM (#32047961)

If it's the kind of report I've seen, it could've been along the lines of Package version X.Y.Z comes with M module which has V vulnerability. Upgrade to X.Y.Z+1, which patched it. They don't actually look at the enabled modules.

[ Parent | on HN ]

Re:Tell HN: Information security audit / consulting is large... by dizhn on Monday July 11, 2022 @08:01AM (#32054984)

I thought it might be that. Yeah.

[ Parent | on HN ]

Re:Tell HN: Information security audit / consulting is large... by icedchai on Sunday July 10, 2022 @05:44PM (#32049388)

Yes, it was exactly like that.

[ Parent | on HN ]

Re:Tell HN: Information security audit / consulting is large... by rtev on Sunday July 10, 2022 @01:59PM (#32047108)

What happens when another dev takes over and loads the module? This sounds similar to using a vulnerable library without invoking the vulnerable function - it still could unwittingly be used in the future.

[ Parent | on HN ]