altharaz

Very great article.

At the moment IMHO the major issue comes from that people use only the Basic Score of the CVSS 3.1, issued by the NVD.

Indeed, if you also take the Temporal Score (with CTI feeds for example), and if you add the Environmental Score, then you can have very good results to help prioritizing the vulnerabilities on your assets and reflect the real threat.

I would also like, however, to see the CVSS4 with a "cost to patch" component: in OT environments, CISO like to use the SSVC because it’s the easiest way to say "wait" instead of "patch now". But since SSVC is not really recognized by all auditors, it generates conflicts. Bringing a component in the CVSS to reflect the cost of remediation on very complex devices, where deploying a KB requires to stop a full factory, could help getting the same results (aka "don’t patch now and wait") but with a more respected scoring system.

From my perspective, that’s the only missing component for a good CVSS system :).

The hardcoded password seems to be:

Gitlab::Password.test_default(21) => "123qweQWE!@#000000000"

Great app, I just bought it and I will try it on the next WebEx conference calls :).

Some remarks:

- the "Highlight cursor at app launch" has a "Start sdf sdfsdf" tooltip

- I can not change the keyboard shortcuts (when I click on the button to configure them, nothing happens)

- the default keyboard shortcut "Control + Option + A" presented in the menu does not work on French keyboards and requires instead to push "Control + Option + Q", which looks like a AZERTY / QWERTY configuration issue?

From my understanding, it's a dataviz of Facebook ads linked to politics.

For instance, if we select "Browse per country" and then "France", you can see political ads, with their political party, their content, their settings, etc.

Meditations, Marcus Aurelius => A lot of wisdom on how to lead and live

On The Shortness of Life, Seneca => An essay about how to handle life and how to see what is really important

On War, Clausewitz => An important essay about strategy and war, politics and management

The Prince, Machiavelli => A little bit cynical but quite realistic about the nature of power in the hands of humans

Thirty-Six Stratagems, multiple authors => A list of strategies that can be used in any situation, whether when winning or losing

From my experience, the password manager is just another issue to solve for this kind of people: it’s another software to use and these users do not like to use software.

As a result, paper is sort of natural for them, and the only way I found to impeach them from writing down their passwords is to make them use passphrases instead of passwords.

They do remember the passphrases they typed in, however the issue is that some websites still refuse passphrases because they are too long :(.

My recipe is AdBlocks + automated updates enabled + firewall enabled + desktop shortcut for web browser + regular antimalware check.

Regarding phishing, I set them up with a GMail account and their filter is quite good against this.

So far, not anything bad happened, some minor malware were installed through malicious web browser extensions, but no financial damage or identity theft.