News for hackers. Stuff that matters.

bryandollery

Re:GitHub Actions could be so much better on Tuesday September 26, 2023 @03:13AM (#37655589)
Have you seen Tekton? (https://tekton.dev/)
Re:We’ve Passed the Carbon Tipping Point on Tuesday May 22, 2018 @09:03AM (#17125572)
Given how important this topic is, this has to be classed as a very poor article. Maybe 6 paragraphs of news, followed by over twice as much scaremongering and speculation.
Re:$36k Google App Engine RCE on Tuesday May 22, 2018 @07:54AM (#17125244)
Software architecture isn't like that. Nobody has a list of all the software running in every datacenter -- not in any large corporation anywhere in the world, and an API isn't going to change that.

And, you can't quit all application servers at the same time. These are distributed, self-healing, and highly-redundant -- meaning that there are thousands of copies of each service, and the system will bring up new copies to replace the ones you kill, without loosing service (though you could, potentially, affect quality of service).

Even the control mechanisms that allow all this magic to happen are run on the same platform, meaning that you can't affect the managers in this way either.

The sort of things you can do are: affect billing and reporting, find sensitive company data, and, potentially, execute code remotely (though that will probably be in a container, and not have access to much else).

Grabbing source code is problematic. There is more than one repo -- in an org this size there are probably millions. The code is huge, so downloading it will take forever, and then you'd have to read it. Finally, it's written in dozens of programming languages, some, like Golang, are unreadable to anyone but experts.

Re:$36k Google App Engine RCE on Tuesday May 22, 2018 @07:45AM (#17125209)
That's not necessarily true, there are brokers that are relatively easy to find. It's more risky at a personal level to go into crime though.
Re:$36k Google App Engine RCE on Tuesday May 22, 2018 @07:43AM (#17125202)
It's not morally offensive to profit from the mistakes of a commercial entity. I'd guess that a large portions of companies are ultimately in this class.

And, really, dictators don't need help imprisoning dissidents -- it's sort of in the jobspec. It's not likely that a vuln would cause this to happen unless it was in systems created and secured specifically for sedition, in which case a researcher should be considerate of the potential damage.

Re:$36k Google App Engine RCE on Tuesday May 22, 2018 @07:35AM (#17125164)
Why wouldn't you just do both? You can get Zerodium to pay you and then go to the 'target' and submit the vuln through their channels. It seems plausible.