I also remember, shortly before the dot-com crash, predictions that all these nonsense dot-com businesses, like "pets.com" with their sock-puppet, would fail. And they did.
Missouri state government computers were making the SSN#s of teachers public. The governor is responding prosecuting the expert and reporter who notified them of the problem. The cybersecurity community is outraged by this.
What gets lost in this discussion is what the law says.
Obviously, everyone should be outraged when a well-meaning whistleblower pointing out government incompetence is then prosecuted by the embarrassed government. You don't need to be a computer scientist to understand the problem here.
Such "disclosure" of vulnerabilities is a standard practice in cybersecurity. Outsiders pointing out problems is pretty much the only way cybersecurity improves -- something that has been known since the late 1800s. So we are especially offended by this.
1/ I've been trying to stalk my parents since Christmas Eve using an AirTag. My dad finally got an alert on the phone. There are many things that'll prevent the generation of such alerts.
2/ For one thing, the tag has to keep moving. When you leave it sit for too long, it turns off. There's no reason to keep updating it's location if its location isn't changing, so it conserve power.
3/ Thus, if stalkers attach it to a car, and the car spends most of its time parked, then the stalkee may not get alerts on their phone.
Napster is not still a thing.
Napster was a peer-to-peer music theft program 20 years ago.
Then somebody bought the brand name and used it to describe a completely different music streaming service.
People respond to this thread claiming Napster is still a thing. It really isn't. As Wikipedia documents, somebody simply bought the name and stuck it on a different music streaming product.
Visiting my parents over the holidays, I of course hid an Apple AirTag in their car to track their movements. My parents are frequently the targets of my various hacking experiments, in this case, AirTag stalking.
I'm trying to estimate how well Apple's anti-stalking features will work, such as the AirTag beeping when it's out of range, or iPhone owners getting a notification on their phones that a suspicious AirTag is nearby.
So far, no conclusions. However, I did have to tell them they are being stalked, so that they don't get surprised and swerve off the road when a strange beeping starts in the backseat of their car.
So many misconceptions in this story: 1. log4j wasn't a software development issue 2. CEOs aren't going to help you solve the problem 3. the problem doesn't need government help cnn.com/2021/12/23/pol…
The log4j vulnerability wasn't an accidental bug, but a deliberate feature. Trying to apply heavy-weight secure software development practices would require 10x as many engineers and still would let problems like this slip through.
It's not "process" but "clue" that was missing. You could bring your engineers together for weeks of "threat modeling", but unless an engineer had a clue about how injection vulnerabilities work, or how JNDI works, you aren't going to get anywhere.