I can tell you that every docker container we had running was vulnerable, and none had new versions as of around noon today.

The manual fix is relatively easy, just change a few configs.

Using a tool like Shodan, I can quickly get a list of addresses that have a specific version of PHP behind it.

It sounds like this is a cvss 9.0 or higher for PHP which is bonkers because PHP is such a huge amount of the internet.

My guess is releasing these CVEs the normal way could have catastrophic consequences. They’re giving stsadmins a heads up so there is less of a scramble when sysadmins read “hey fix your shit it’s totally vulnerable” before they have their coffee.

Like as a sysadmin, this is a great way for them to do this.

I will in 10 mins alert my team that the whole site has to come offline for a period today. I don’t need to take it offline in an emergency and tell my boss to send out a memo.

Literally a single nmap command will tell me where you “hid” your ssh port.

Like the poster you’re responding to said, it is good advice but not for security. It takes you off the hacker spam list, essentially.

Rereading this it sounds like I am disagreeing with you sorry. Just trying to reiterate your point.

Use authelia for 2fa

Disable root ssh

Disable password authentication for ssh. Keys only.

Set up Fail2ban

That’s about all that’s left; 2fa and brute force protection. Good job.

I stood up grafana at work, and I make dashboards to keep my role secure.

Everyone uses my shitty little dashboards :)

Everything else is just those tools but you’re abstracted away from some level of control.

Or ELK.

I used to keep a charged spare on me. And this was back when a phones battery life was like 3-7 days.

Stop making phones thinner God dammit. I don’t want a thinner phone. I want longer battery life and a removable battery so I can fucking double the shitty longer battery life I get.

I was gonna say it looks like a keychron. I have like 5 in my house. Their mice are great too. Big fan. Waiting for the other shoe to drop.

I just need a few more billion and it’ll become profitable, I swear.

It really is not common in the common era.

E-business suite is not a firewall. Anyone that was using it as one when this cve hit about a year ago wouldnt have qualified as “enterprise” to any required insurance, even then.

Anyone who was using it as such was/is drowning in so much tech debt that, like, if you work there, leave. Yesterday.

Frankly to suggest that an enterprise firewall would be susceptible to a simple path traversal attack is insane. Unless there’s the most embarrassing news story of the decade im missing? That kind of input validation is baked into basically everything these days.

Maybe you’ll land input validation using quadruple URL encoded ‘…/’ or something but even still I’d doubt that.

So the person who replied to you is 100% correct in what it’s about, but it doesn’t really explain the comic. Unless it was made in like a decade ago.

I gotta say I might dislike Microsoft more than Apple…

But I kiss ground returning to Linux or Windows after being stuck on Mac OS.

Windows is an old comfort. I know all the shortcuts. I hate their brand, ethos, etc.

But when I am stuck using an Apple product I want to rip off my fucking skin. Fuck your command key, stop trying to be special. Your system tray is obnoxious. I hate your unified application menu bar, it makes no sense with un-maximized windows. You got rid of the single button mouse because yeah obviously that was stupid, why not get rid of the rest? Firewire? Fuck off. Those fucking charging cables. Fuck. Off.

Fuck Microsoft, but Apple don’t catch enough hate. Fuck them too for their benign prison of an ecosystem.

…

Sorry. I get way more bent out of shape having to use macos or ios for work than I do windows. Way more. Fuck em both. I can handle powershell. I cannot handle a fucking circus of bullshit.

Every Mac I must use at work gets a Linux VM. I will not tolerate their operating systems. I don’t do the same for windows at work. I tolerate it.

I stood up a test, staging, and prod pair of web server/dbs, got the Drupal 8 site stable on Drupal 10, hand it over, and yeah. No one uses anything but prod.

Thanks for 3x the work, ya dicks.

I literally live between ops sentiment and this sentiment

I stand shit up as a test server and then threat model before cloning a production server to a separate vlan and lock it down proper, with the added Intel of a snapshot on how the test server got tested.

Yeah anyone who bought a lifetime Plex pass back when it was very reasonably priced is left looking at the jellyfin/Plex debate a bit crosseyed.

If you don’t have a lifetime pass, and need to cut costs, go jellyfin. Otherwise, I choose Plex.

Anyone else catch shit for saying machine or box?

“Yeah it’s a Windows box so whatever is trying recon knows nothing and hasn’t learned after repeated attempts.”

“The Honeypot? Yeah just a Linux box that blows up our alerts channel if anyone tries to touch it.”

Etc.

Most paid solutions are just kibana/grafana dashboards with extra steps.

If your team can’t build most of that shit out yourselves, your team is overpaid.

Not very common…? It’s fine to learn a new word, but don’t go pretending that’s the words fault.

Meta is a word that has meaning.

100% building a home lab and being able to talk about it openly, from memory, in your own words, from experience, is invaluable for interviews.

I might update this. I might not. I have a lot to say but In out drinking.

All I will say now is save this list. You’ll look back at it in 5 years and wonder what half of those things are.

…

Okay a bit more from the bar:

If you want dev sec ops, grafana, elk, build dashboards, get your agents setup in your fleet, get it all secure locally. That alone will impress any interviewer who knows anything.

Dev ops specifically? Focus on building a local GitLab instance. Use grafana to monitor it. Run some app that has a busy db. Grafana dashboards on that. Oh my goodness, what a HOG you are GitLab! Tune it for your env. Purposely misconfigure something to watch, idk, the RAM keep growing because you didn’t setup redis or some shit.

The sea is vast. You’re hungry. Employers will see that once you land interviews.

If you want a ton of dev sec ops ideas, I am a good sounding board. Regular dev ops isn’t my daily grind so I know a bit less. What I do know is if you’re not ready to rebuild a multi node cluster some night after hours, you’re not quite a boss (doesn’t mean you’re not ready). So, emulate that nightmare.

Back to drinking 🍻

Edit: double check your *arr ideas bc afaik most of those were abandoned after a few major vulns were uncovered. That was months ago so that may be old hat.