John Strand

Pro tip!

In security, never say the following:

"That is old."
"Nobody uses that anymore."
"We don't need to worry about X attack vector."

It screams that you are inexperienced and/or you don't know what you are talking about.

Jan 12, 2023 at 6:12pmWeb
Show threadChris John Riley  Jan 12, 2023
@strandjs I get what you're saying, but it's sad that fixing an entire class of vulnerability isn't common enough for us to even entertain saying that we don't need to worry about it anymore. There are far too few examples of things we've actually fixed (reliably)!
Show threadIntelSoup Jan 12, 2023
@strandjs To also add to the list, "It's ok we all use Macs"
Show threadVissJan 12, 2023

@strandjs one of the presenters at a con I went to last year unapologetically scoffed at how appsec people dont need to care about networking at all because its someone elses problem.

the entire incubus song 'blood on the ground' ran through my head, but i didnt say anything. I said something like "well, thats certainly a mood".

Show threadVissJan 12, 2023
@strandjs we're in for some super 90s style architecture related security problems if we have "security people" openly disregarding networking in its entirety
Show threadNick LupienJan 12, 2023

@strandjs If the port's open and/or the service is running, it's not old.

I've often worried about how orgs age off old detections based on those excuses. Sure, it's for efficiency, but at what cost.

Show threadJoshJan 12, 2023
@strandjs or in my interactions it's that they consider themselves "too experienced" and don't want to keep learning
Show threadCTaymor has movedJan 12, 2023
@strandjs @hacks4pancakes “nobody uses this anymore” oh how deeply deeply untrue that always is
Show threadLars Erik BraatveitJan 12, 2023
@strandjs but I do cringe a little when major vendors list Back Orifice detection in their current IPS software
Show threadsailingbikerukJan 12, 2023
@strandjs but I am old, nobody really uses me anymore and I haven’t worried about being attacked in decades.
Show threadPhil CalvinJan 12, 2023
@strandjs Also never helps to say "I don't think we still have any of those on the network."
You're likely wrong.
Show threadFalcon DarkstarJan 13, 2023
@strandjs counterpoint: having to repeatedly rebut sometimes dozens of "findings" declaring I am running web forum software that hasn't seen use since a decade before the founding of my company, because the vendor can't be bothered to write more specific signatures.
Show threadAMSJan 13, 2023
@strandjs "That's Old" is only to be said with "oooo" as in "Cool! An actual Vax still running!"
Show threadTheYoctoJesterJan 13, 2023
@strandjs … and it instantly gives away that you have no clue about embedded / IoT devices.