Re:Ridiculous vulnerability disclosure process with CrowdStr...
by horsawlarway on Tuesday August 23, 2022 @01:53PM
(#32568550)
It IS trivial. Period.
If you don't want people to modify the machine - don't give them admin access.
If you give them admin access... don't assume they won't modify the machine.
For comparison - I worked software security for 5 years dealing with fortune 100 banks. I have zero faith in the industry. It's mostly a shell game for liability.
I can absolutely do the things I mentioned above. At best, it's a discussion of how hard I'll have to work. So again... this is basically a "hey - you're about to violate company policy" notice.
If you don't want people to modify the machine - don't give them admin access.
If you give them admin access... don't assume they won't modify the machine.
For comparison - I worked software security for 5 years dealing with fortune 100 banks. I have zero faith in the industry. It's mostly a shell game for liability.
I can absolutely do the things I mentioned above. At best, it's a discussion of how hard I'll have to work. So again... this is basically a "hey - you're about to violate company policy" notice.