igama

Yes

"Tim wasn’t delivering software; Tim was delivering a team that was delivering software. The entire team became more effective, more productive, more aligned, more idiomatic, more fun, because Tim was in the team." - This happened years ago to me, with a manager pulling me aside and asking why my Tickets resolved were so low... They only cared about the number of tickets worked on...

Because most people don't care about it and forget about it in the long term?

Same for me. I find it boggling people that can listen to audiobooks, podcasts, to shows while working/coding.

Check the timestamp of the results ;)

The free page securityrating.io from BinaryEdge also provides that information.

For more complex queries about what is being exposed on IPs worldwide (IPV4 and IPV6) You can register a free account on app.binaryedge.io.

(Disclaimer: I'm part of the BinaryEdge team)

Reply by Alex Stamos:

https://twitter.com/alexstamos/status/1268062452123496450

No one can answer that for you, you need to test it out your self. Depends on size of documents, number of keys, volume of reads, etc etc. Spin up 1 instance and test it out ;)

One way for example would be store all events you want to write to ElasticSearch to a Queue (like rabbit, Kafka, etc) then have a set of workers/importers (this can even be logstash with input from queue and output ES) that read the events from that queue and store them in ES.

This way your system becomes a sync, and your system above is not affected if ES becomes slow writing or goes down for a reason. Your events will remain stored in the queue waiting to be processed.

"If the Police have a legit reason to access a property they go to court and get a warrent, and if they need to they'll kick the door in to get in." That's what currently takes, place, Government doesn't have the keys, they have to use force to get in, or other methods. (However there are physical limits to materials, so there is usually a way to break in)

But, by having a special key that opens all the doors, anyone could copy it - yes rules can put in place to who as access, etc, etc, but by knowing there is a "hole" in each device, every possible malicious agent will try and break it as soon as possible. Then what?

We have seen examples by Law Enforcement officers using accesses to gather data that would required a court order, but they didn't have one, and it was for personal reasons. So, how does that work out?

Same feeling...

Opendistro was announced by AWS a few weeks ago. It’s their fork of ES with security features and some of the XPack functionality included.

Exposed (Open/NoAuth) Databases in Austria: MongoDB: 26 ElasticSearch: 14 Memcached: 4 Redis: 6

Others: Synology DiskStation NAS ftpd: 299

CTO Binaryedge here. For those wondering, We have detected more than 15k Kubernetes APIs with Auth. This post focuses on ~1.5k found without Auth, that are fully open.

It's not just a Kubernetes Problem. Like many have posted, many databases, other types of clusters, shares, are accessible without Auth for those that know how to look for them (not that hard now days), mainly malicious actors.

Exactly, the main story is Kubernetes being exploited in the wild and in large numbers, Crypto mining is just one of the "attacks" tacking place.

We scan the entire internet space and create real-time threat intelligence streams and reports that show what is exposed on the internet. Our objective is to help you answer questions like: - What services is your organization exposing? - How many IOT devices are accessible? - How many services/databases are miss-configured? - What DataLeaks have affected a specific e-Mail?

I've updated the link.

Cached version : http://webcache.googleusercontent.com/search?q=cache:https:/...

*updated link

This is based on a Open Risk formula we are working on, https://github.com/binaryedge/ratemyip-openframework.

"Building a hardware startup is hard, but trying to build one that competes with Apple is nearly impossible."

So what is it? Hard or not?

Have a read of the Internet Security Exposure report by @binaryedgeio, there is a section regarding Data Storage, mentioning Mongo, Redis, ElasticSearch, and some other. In Summary, it was found 627.7 TB of Data Exposed.

http://blog.binaryedge.io/2016/10/07/internet-security-expos...

"Don't forget on a Peer to Peer Network usually if you can see them, they can see you."

True, many seem to forget that.

"Regarding Samba/SMB (...) 79% (1424) has weak or no authentication, which means that anyone could access the files in these servers without any username or password, e.g., critical business information or private financial records."

Companies still miss the basic security configurations, and then they are surprised they were "hacked".

Looks pretty cool, going to test it soon.

It might sound like a lot, but in the Swiss context, it's not that much. It's a really expensive country to live in, especially in the main cities like Zurich and Geneva. For you 2,256€ is great, but in Switzerland, it's considered good income for a student/intern, that's how expensive it is. (compare that to Portugal where they can pay a intern 150€/month).

"Startups either go Facebook or go bust" For me, this reflects the problem with the current Startup mentality.