@TerryChia yeah that's become a thing in ruby gem land you can put a git repo into the Gemfile and it'll go get stuff from there. Nice from a functionality perspective, really makes me shudder from a security perspective
the number of projects that are one github account compromise away from security problems is likely very high....
@AviD yeah my connection was delayed and I was worried I'd miss it. 'cause I was first class they had a personal rep meet me on arrival and walk me through the airport with a variety of tickets to make sure I had one that would work. brief view of how the other half live :)
@AviD one of our customers that we do sub-contract work for decided that they want them on all reports. I'm trying to explain why there's no CVSS for "hasn't implemented HTTP Security headers" and why making SSLv2 a medium finding makes no sense
@JNK you may want to ask when a couple more of our american types are about they may well know of more US focused venues. look out for @ScottPack , @tylerl or @aj-henderson, they're on here reasonably often...
@AviD ok, I didn't think I was going crazy, but I've been catching a lot of flack on my answer about the (relative) safety of having a virus as a data file on your system
granted, that isn't too surprising as I'm covering a lot of territory in a fairly short post for the amount I'm covering
and people tend to forget that while there are edge cases examples of exploits that can do code execution from a passive state, there are also (roughly as many?) cases of demonstrated vulnerabilities that may allow escaping a VM
which was the main "solution" offered
which yes, is a good step, but also isn't surefire
so yeah, wanted to make sure I wasn't losing it
I haven't played extensively with viruses in a few years