Tenable, maker of the Nessus vulnerability scanner, publishes security research on vulnerabilities, exploits, and scams.
HN links it for vulnerability write-ups and its post on crypto giveaway scams; commenters also cite its CVSS prioritization post, and recruiters post jobs there.
Nessus is probably (still) the best for Linux in this field (certainly in the "free for home use" category): http://www.tenable.com/products/nessus
Lots of vendors have offerings in this area. The quality is ... variable. If you are thinking of getting into this market, then the hard part is not the scanning engine per se. The more difficult parts are:
* Keeping the policy rule set in sync with reality (changing business policy, attack and vulnerability landscape)
* Maintaining the rule set (are DSLs for non-specialists feasible? service model?)
* Interpreting and actioning the results in a timely fashion (eg http://measurablesecurity.mitre.org for some background)
* Intrusiveness (intrusive validation of a test platform requires careful change control -- is test identical to production? intrusive validation of production may lead to shot feet)
* Application, domain-related and physical security (as opposed to system security captured by this document). These things are harder to scan for automatically.
Tenable Network Security | Senior Full Stack Web Developer | Columbia, MD | Onsite or Remote | Full Time | https://www.tenable.com/
We are looking for a full stack web developer who loves building impressive web applications. Quality, best practices and "wow factor" are very important to you. User experience is paramount. You have the ability to identify UX pain points and resolve them without direction. You like to stay current with technology and are a self starter.
The team is small so we have high ownership of our software. We are responsible for the full software development cycle, starting at design and ending with deployment. It has always been important to us to stay current with the latest technology and use as needed.
Tech Stack: Ruby on Rails, Node, PHP, AWS, React, Docker, MySql, Postgres
https://careers.tenable.com/?p=job/oFof4fw6&__jvst=JobBoard&__jvsd=Hacker_News&nl=1
> There is a place for C, where there's no alternative.
Alternatives to C have started appearing for a long while, and they are quite mature now.
> because they are not doing kernel development
FluentBit, where this error occurred, is a userspace application.
> there is no reflection when they fuck up a codebase
C does not support runtime reflection, that is correct. It's one of the reasons why it's a programming and debugging nightmare.
> If you are using some tricks for type casting to implement your ideas into code
There seem to be no casting issues involved in https://www.tenable.com/security/research/tra-2024-17.
> The best code is the code that is safe and easy to read, and doesn't need to use "clever tricks" that beginners cannot understand.
It's just a pile of truisms.
Is your whole post even related to this article?
For some distributions, CIS benchmarks (also used by various other security tools) now include guidelines for SELinux.
I couldn't find it in the Debian spec (probably because it uses AppArmor), but the RHEL benchmark has these.
Currently, server level 1 only requires permissive mode:
https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_Linux_9_v2.0.0_L1_Server.audit:647bbbfd028918a81c7a5281238e1361
CIS Red Hat Enterprise Linux 9 v2.0.0 L1 Server — 1.3.1.4 Ensure the SELinux mode is not disabled ... While server level 2 specifies enforcing mode:
https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_Linux_9_v2.0.0_L2_Server.audit:acfe5d2a8c034a12a564619db0c03838
CIS Red Hat Enterprise Linux 9 v2.0.0 L2 Server — 1.3.1.5 Ensure the SELinux mode is enforcing
Well, if you sent an email to `|program` it didn't execute program. Seriously[1]
[1]: https://www.tenable.com/plugins/index.php?view=single&id=10261
Indeed, many sysadmins of the time lauded qmail's lack of supporting "standard features" in the name of "security" which sadly was still a new concept on the Internet.
Something to consider: SMTP over TLS offers some privacy and confidentiality between two mail servers that have established a trust relationship, but it offers no protection against an upstream network (who can simply fake some DNS records and get a letsencrypt certificate) or a state actor (who simply threatens the CA). I think referring to "SMTP over TLS" as "secure" is dangerous because it leads us to equate "more code" as providing security.
I see the point especially with foreign addresses. It can be bit of a challenge to communicate addresses like "Nándorfejérvári út 4" or "Kısıklı Büyük Çamlıca Cd. No:9" over the phone. Coordinates are of course alternative, but for most of us, few words and number are easier to keep in mind for few minutes.
The given notation is hard to decode inside the head, but if you can memorize it for 30 seconds then you can fire up an app to do the decoding.
Pictogram is clever idea for the checksum. Probably something that sticks to your head. Reminds me of the Lotus Notes login dialog [1], [2]
[1] https://blog.codinghorror.com/the-dramatic-password-reveal/
[2] http://www.tenable.com/pvs-plugins/1305