I accidentally logged hundreds of thousands of phone calls to military bases
lina's blog
I accidentally logged hundreds of thousands of phone calls to military bases
How an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.
I’m a stickler for security but any time I mention concerns even to project owners and seasoned engineers I only get vacant stares. Don’t trust anything cloud to keep your data safe. Nobody cares.
Yeah, the number of times I heard “that’s an edge case” when it came to security so we didn’t have to invest dev time was maddening. One of my old employers, if you know the right URL to call, you can just mass print whatever you want from the open internet. But because it’s an “internal application” it was deemed not a concern, simply because most of the people who are intended to use it wouldn’t know how to inspect network traffic.
So much security through obscurity, or worse the dev doesn’t know how to do it properly and doesn’t have time to learn it. So many completely open blob storage buckets allowing full read write, cors * * *, I’ll roll my own authentication, database with plain passwords. “No one should be able to get to there anyway”
Boss wouldn’t even listen to using a nonce per call because the caller and target used different databases. Same back end, just different databases.
It’s not so much about keeping it safe as it is doing the minimum required by law to make sure someone else is liable.
Sadly it is not even a point of awareness. When bringing it up, the first reaction is surprise. The second is disinterest.
I’ll be happy when we stop calling things “the cloud”. Maybe “upstream processors” or something would be better.
That’s never going to change. It’s cloud infrastructure. It’s not a company specific term, it’s industry wide, and convincing an entire industry to arbitrarily change what we call something won’t happen. Even changing from master to main isn’t the case everywhere, and main is the default now.
Also, ‘the cloud’ is both easier to say and remember than ‘upstream processors’, which in itself isn’t an accurate name for cloud resources, really just one resource.
‘The cloud’ to non-IT people is just remote hosting or processing. It’s marketing terminology. Everything with a client \ server where the server was off-site suddenly became “the cloud”. If you have elastic resource computing on site, is it still “the cloud”? Sorry I just never liked the term because it was used so broadly and to generate excitement among non technical people.
Off-site resources aren’t by default a cloud solution. The differentiation is mainly in a cloud, it’s a cluster of shared resources that host virtual machines and are connected through virtual networks. Having a dedicated server to host your stuff on is just remote hosting. A company can setup and host their only cloud infrastructure if they want.
To non IT people, the difference between interfacing with something in the cloud or a dedicated hosted setup doesn’t exist. If they post a comment on Lemmy, that’s may be hosted in a cloud or hosted locally on a server somewhere. If they are storing pictures in Away, then that is cloud storage.
So their is a distinction on the back end mostly, but it’s just the way resources are hosted and shared, so the front end would be the same regardless.
Oh I like cloud. It’s pretty similar because to put something into clouds you have to burn it or you are a stoic believer against all odds (and sciences)
Interesting read! I should tinker more with the DNS. 🤔
DNS is like spiders. The visceral fear is justified, but if you can get over it you can learn interesting things and have fun
And you eat around 8 dns queries in your sleep