kpeekhn
Re:Rest-client gem is hijacked
on Tuesday August 20, 2019 @09:55AM (#20747071)
sorry, that is not what I mean.
I don't care really about a badge, I care about the information being available so that it can be used in Bundler. Its about developers being given the choice in their gemfile to disallow installation of any gems uploaded without 2FA. But in order to do that, we need rubygems to publish that information.
Re:Rest-client gem is hijacked
on Tuesday August 20, 2019 @09:40AM (#20746868)
It would have prevented this attack, so I'm not sure how its pointless. Obviously it doesn't fix everything. MFA is MFA. I don't know why anyone would take it as a guarantee that some third-party has audited all the code.
Re:Rest-client gem is hijacked
on Tuesday August 20, 2019 @09:29AM (#20746747)
Is there a way to check if a gem was released by an account using MFA?
If there was a "published with mfa" flag on every gem release and it would allow a Bundler setting to block installing gems without 2FA.
Of course, this would also help attackers find targets. But maybe its worth the trade-off?
Re:Major breach found in biometrics system used by banks, police and d...
on Wednesday August 14, 2019 @09:15AM (#20695153)
Isn't it normal to send passwords over HTTPS? This is usually how login and password reset work. Obviously you have to be careful they don't get logged.
Re:Hundreds of exposed Amazon cloud backups found leaking sensitive data
on Friday August 09, 2019 @05:08PM (#20658272)
AWS Trusted Advisor has warned of this since 2017:
https://aws.amazon.com/about-aws/whats-new/2017/06/aws-trust...