@TerryChia Yeah, I remember seeing that several months ago. But I wonder what the end goal is. They mention getting your patches into mainline as part of the challenge, which sounds... questionable. I have half a mind to sign on just to see what they're playing at.
@TerryChia well, what if they start with pre-arranged puzzles for you to solve and then switch to solving actual bugs or feature requests, even though you think it's still all made up.
@TerryChia The way it looks like they operate is that to get started you pull an image file from their repo. What security checks are done by them on images in the repo. It seems improbable that they'd review the whole OS as there's loads of them in there (a search for rails images turns up 98 results)
the concept of downloading a relatively random OS/app stack over HTTP (I think need to check) and then using that as the base for a part of your business makes me shudder ...
here's a scenario for you. Want to PWN lots of start-ups. make some really good chef/docker/etc images and put a little additional binary in there that calls home after a couple of hours...
@TerryChia yep but the whole concept of the tool is that that's how it should be used...
@TerryChia srsly happy path is run totally untrusted code from the 'net and that's not a security issue.....
heck I looked at openstack a couple of days ago via devstack and the idea for that is "to install run a shell script on your server as root and we'll go install a ton of software from a variety of locations, good luck doing patch management with that"
@TerryChia sure, again one point is I'll wager that people use it for prod like tasks, but the other is that I'm guessing it uses the same components as open stack, which looked like a bit stack of open source components. I'd hope that anyone installing it for real will validate each component before using it, but....
@RоryMcCune RHEL 7 will have support for it as well. But something being in an LTS distro doesn't mean that you should be using it right now. If you aren't waiting for 1.0 before running in prod you are either very brave or very stupid. :P
On another note, I wonder how long I will need to compile the linux kernel in a VM....
@TerryChia I'd agree that people should be being very careful about using it, but I'd say that inclusion in an LTS distro is likely to make a lot of people think it is stable especially when ubuntu are making a point of the added support on their blog (with no caveats about it not being ready for prime time)
@DavidFreitag sadly, I haven't had the time to practice Blackjack, so as I'm not prepared to lose money I will not be gambling. I'm actually not a fan of Vegas - it just reminds me of a debauched Blackpool with more lights and money
I do love the countryside around it though - the bits without any humans
@DavidFreitag I know - but I'm not getting there...I'm taking my wife along on this trip, so we'll be checking out the Grand Canyon, Lake Mead, Zion National Park and a couple of other bits
@DavidFreitag We have some reasonable offers at venues both east and west coast - but the travel makes it not yet feasible. Discussions are underway - it could yet happen
I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the whole internet. This made me wonder - what security mechanisms protect the BGP protocol and why did...
@RoryAlsop when we did the canyon trip we went with these guys pinkjeeptours.com/las-vegas . was good and the bit we went to hardly had any people, just a crazy cowboy dude sleeping right on the edge
@tylerl I stocked up on it before Easter, so I dunno about you, but I'm drinking it :P Google says that Merlot has 0.7 mg of iron per serving, that's good enough for me
@tylerl I have discovered, through perusing their site, that one of the tours does use pink Jeep Wranglers. Guessing they then expanded into the big custom built things
@mikko @matthew_d_green @jamesrbuk HT @smartinez Microsoft OneDrive injecting identifying data into files http://www.myce.com/news/microsoft-onedrive-for-business-modifies-files-as-it-syncs-71168/
@DavidFreitag I do find it a bit surprising, because it's not like they could have expected that nobody would notice. If it's truly a "bug" then the accident was that they got caught, not that they've been putting tracking cookies in your files.
...y'know, that may be a good question. It's just a bit too late for me to decide. And there was another beer festival 48 seconds walk up the road from my house, so I am in no state to make competent decisions on anything
We have someone asking about THC Hydra on Unix & Linux, and no experts to answer. This guy isn't good at asking questions, so for all I know his questions may be crap.
