zwass
Joined 15 years ago
Karma
754
Submissions
133
Member since
Aug 12
Recent submissions
Comment · 2 years ago
Disclosure: I'm CTO at Fleet. One of the biggest challenges is the vendor lock-in that results from the way the MDM systems work (particularly on macOS). In typical MDM solutions you don't own the keys and can't manage migrations without direct interaction from every end user. We expect Broadcom to milk this friction while they can.
Comment · 3 years ago
Disclaimer: I'm the CTO
One of my favorite things about this is that we are bringing a GitOps workflow to IT teams. As a software engineer myself, seeing change management and CI coming to other domains within the organization is incredibly exciting!
Source code for Fleet is available at https://github.com/fleetdm/fleet.
Comment · 3 years ago
Super cool! It would be great if the description field had a link to the subreddit and a link to the master list.
Comment · 4 years ago
This is an interesting looking product. I grew lettuces using the Kratky method in cheap plastic bins and some standard shelving units, which was relatively low effort and had tremendous results at about 25% the cost of this unit (but much less stylish). This looks like a decent intro guide on Kratky: https://www.trees.com/gardening-and-landscaping/the-gratky-m...
Comment · 4 years ago
There was a similar instance of a fake student living on Stanford campus about 20 years ago. I wonder if this is common among elite schools, or if Stanford has some special draw?
Comment · 4 years ago
Fun! I kept thinking about doing this. Love your idea to use the dot-matrix tool. Maybe next a GitHub action to keep it updated and/or change it over time?
Comment · 4 years ago
Fleet | Remote (Worldwide, Americas Timezones) | Full-Time, Remote | https://fleetdm.com
Fleet is building an open future for device management. Open APIs you can use from anywhere. Transparency for end-users. Trust built on an open-core foundation.
We are looking for an Engineering Manager on our Agent team. This position will be responsible for managing the engineers and strategy for:
- Osquery across Windows, macOS, and Linux. - Fleet's agent update system based on The Update Framework. - Fleet Desktop (Desktop application for user notifications and self-remediation). - MDM features.
Join our team of friendly and competent engineers to expand our 100% source-available (github.com/fleetdm/fleet) endpoint management product. We work closely with the osquery community, and have both paying customers and open-source users from organizations you’ve heard of. We’re backed by CRV and Sid Sijbrandij (CEO of GitLab).
This role will report directly to me (CTO), please reach out with any questions: zach[at]fleetdm.com
Comment · 4 years ago
(I'm on the osquery steering committee)
In theory osquery is "just" virtual tables, but in practice there's quite a bit more that would probably make attaching it to mvsqlite. If you have a use case in mind I would love to know!
Comment · 4 years ago
For folks who have announced funding rounds, how common have you found these kind of attacks?
Comment · 4 years ago
I would be commending them if this notice went out March 3 after they had remediated the problem and were aware that they had no logs to determine whether there was abuse.
Comment · 4 years ago
contents:read to contents:write is a big deal! Just to pick out a random widely used project, nodejs [1] has a number of unsigned commits to the main branch. Their commits could have been tampered with during this timeframe.
What about release artifacts?
Comment · 4 years ago
Their statements indicate they were aware and investigating. My frustration is that they didn't give users the opportunity to do their own timely investigation.
> GitHub learned via a customer support ticket that GitHub Apps were able to generate scoped installation tokens with elevated permissions. Each of these tokens are valid for up to 1 hour.
> GitHub quickly fixed the issue and established that this bug was recently introduced, existing for approximately 5 days between 2022-02-25 18:28 UTC and 2022-03-02 20:47 UTC.
> GitHub immediately began working to fix the bug and started an investigation into the potential impact. However due to the scale and complexity of GitHub Apps and their short-lived tokens, we were unable to determine whether this bug was ever exploited.
Comment · 4 years ago
It's unbelievable to me that they waited over 3 months from when they became aware of this vulnerability until disclosing to effected organizations.
https://fleetdm.com/