mol4711
Re:Log4j 2.15.0 – Previously suggested mitigations may not be enough
on Thursday December 16, 2021 @04:45AM (#29576627)
This JNDI "feature" is 8 years old. It was merged in 2013 from what I have seen, and has been defended by some as an "useful" feature. It has been known since at least BlackHat 2016 presentation that this is an incredibly dangerous and stupid thing to keep.
cricket noises nobody reacted until now when minecraft servers got hacked.
Re:Hetzner Cloud Goes US (Ashburn/VA)
on Wednesday November 03, 2021 @08:46AM (#29093815)
The Schrems II judgement might be applicable. I know that in the EU-based company I work for we have strict requirement for all cloud providers to comply with Schrems II, and not send/store any personal data to outside EU.
Re:SolarWinds hackers were able to access Microsoft source code
on Thursday December 31, 2020 @10:17PM (#25600505)
How about their bug tracking software, MS equivalent to Jira issue tracker (I assume they aren't using an outside product).
Do we know if they had access to their issue tracker? That would make it far easier to make zero-day exploits faster.