Skip Navigation
InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)CY
Posts
1
Comments
66
Joined
2 yr. ago
cybersecurity @infosec.pub
CyberSeeker @discuss.tchncs.de

MITRE funding for the Common Vulnerabilities and Exposures (CVE) program will expire on April 16th

infosec.exchange BrianKrebs (@briankrebs@infosec.exchange)

Attached: 1 image I boosted several posts about this already, but since people keep asking if I've seen it.... MITRE has announced that its funding for the Common Vulnerabilities and Exposures (CVE) program and related programs, including the Common Weakness Enumeration Program, will expire on Apr...

BrianKrebs (@briankrebs@infosec.exchange)

Why indeed

  • Curious if this is so broadly true without bundled resources; obviously screens are higher DPI, so even buttons are now designed for at least 8K resolutions, even if most consumers are still on 1080p.

    Orders of magnitude beyond 640x480 or pre Windows 3.1 resolutions.

  • Explain your thought process here, how did you arrive at the larger bottle being 90% more detergent? It’s EXPLICITLY clear that the concentration is higher in the smaller bottle.

    You could complain about the form factor or lack of precision in dosing loads using the higher concentration, but “detergent” is mostly water, which they clearly said they reduced by 75% (same solute, with less water/solvent = higher concentration).

    Quick search and going by what it says on the label, the cost per load has not significantly changed, a little more than half a penny’s difference:

    Ultra Concentrated (left) $15/60 loads = $0.25/load https://mrsmeyers.com/collections/laundry/products/ultra-concentrated-laundry-detergent-rain-water?variant=50673207640338

    Standard (right) $18/74 loads = $0.2432/load https://mrsmeyers.com/collections/laundry/products/ultra-concentrated-laundry-detergent-rain-water?variant=50673207640338

  • Shouldn’t be this hard to find out the attack vector.

    Buried deep, deep in their writeup:

    RocketMQ servers

    • CVE-2021-4043 (Polkit)
    • CVE-2023-33246

    I’m sure if you’re running other insecure, public facing web servers with bad configs, the actor could exploit that too, but they didn’t provide any evidence of this happening in the wild (no threat group TTPs for initial access), so pure FUD to try to sell their security product.

    Unfortunately, Ars mostly just restated verbatim what was provided by the security vendor Aqua Nautilus.

  • Possible? Yes. Likely? Not at all.

    To perform a zero knowledge proof, you’d have to have structured data to support the claim, which most whistleblowers would not have. If a whistleblower already had the hard evidence in hand, e.g., serial numbers and timestamps, they could have just provided those anonymously, and someone could follow up. The problem is, you can’t always get a copy of the hard evidence without revealing your intent to the employer, or at least, other employees.

    Presumably most whistleblowers are making unsubstantiated claims that something happened, or maybe with light evidence. Based on who they are, a journalist or investigator may then elect to follow up and dig up the hard evidence to support the claim. This requires revealing your name and position/relationship to at least one person. Rarely, they would be willing to put themselves out there to provide an affidavit under oath, which itself is not enough to pursue criminal charges (though it could help build a case around intent or willful neglect, or help support a warrant or discovery).

    It’s illegal, but not unheard of, to try to force journalists to reveal their sources, but the same protections are not universally in place if you reported a finding to a company’s internal affairs, for example. But unlike attorney-client privilege, or shield law protections, the risk in signing an affidavit is, as we’ve seen in recent US trials, that records will not stay sealed, and your name will be revealed to the defense and/or public.

  • The Model S Plaid, MG, Rimac Niverra, etc are increasingly limited by regulations more than anything. Quite literally, they are at the limits of rolling friction for street legal tires, which is why you’re not seeing a lot of variance at the top of the market.