← Back to context

Comment by ang_cire

17 hours ago

No self-service sign up for your app. No public access to the app itself. Website that let's you submit a sign up request form. Team reaches out and reviews your request, creates an account in the app dash for you, and you set up mTLS to get access to the dash.

20 comments

ang_cire

Reply
clickety_clack  17 hours ago

In-person requests for access to any app. Request interview includes word association exercise that monitors your emotional reaction to a string of key words.

  • ang_cire  16 hours ago

    You joke, but the space I work in actually does do video calls (or in our case in-person meetings if they're local to SF, often) before onboarding new customers.

kube-system  16 hours ago

LLM discovers exploit -- you don't realize it in time because you don't have a security team as big as the PaaS you used to use -- you get pwned anyway.

This has happened to many high-profile self-hosted pieces of software just this past month.

  • ang_cire  16 hours ago

    An exploit in what, the network stack of the Linux distro you're using for the mTLS proxy? Or the crypto module? Sure, could happen. But then, you're unlikely to be the top target of anything.

    Or do you mean a customer was running it?

    • kube-system  16 hours ago

      There have been a lot of exploits for a lot of software on-prem tech stacks rely on just over the past month - proxmox, php, nodejs, palo alto, eMudhra, etc come to mind.

      > But then, you're unlikely to be the top target of anything.

      That would have protected you 3 years ago when a human had to bother to attack you. Today it doesn't protect you because it's trivial to deploy an LLM to act like an APT against any random target that shows up in shodan.

      It takes more effort to secure on-prem software today than it did just a couple of years ago. Updates are more frequent, zero days are more frequent, attacks are more common, more persistent, and more automated.

      I think most people responsible for securing production systems today will share the experience that their workload has increased.

      7 replies →