Dear Fedi,

Quick question: when would you follow a company on the Fediverse?

(I'm trying to get rid of LinkedIn and get freelance work somewhere ethical...)

#askfedi #hivemind

https://www.youtube.com/watch?v=xyup-362r1w

Respect, at that age such a great #punkrock song and then such current lyrics!

Well done, guys!

Eye opening video examining the US education system and the consequences of 250 years of that system:
(Don't get fooled by the title)

https://youtu.be/j9MubNsh3rs?is=PA43lvHZ-49uteMo

Anyone ever used CrowdSec?

https://github.com/crowdsecurity/crowdsec

I mean the logo are 3 llamas with sunglasses, so @jerry must have used it 😂 (if not programmed it!)

#infosec #NIDS #HIDS #NIPS #HIPS

(post describes my experience and does not represent my employer)

LinkedIn post (see also screenshot): https://www.linkedin.com/posts/johannes-greil-189bb813b_cybersecurity-infosec-workexaminer-activity-7386384177107116032-T3ow

I was involved in the mentioned cases and can only warn every penetration tester of bug bounty platforms.

I worked in an official CVE Numbering Authority (CNA) and we were legally threatened multiple times by vendors.

While bug bounty platforms claim to be a "safe harbor" and claim to mediate in difficult situations, in every instance they told us we have to adhere to the policies of the platform and didn't help any further. So, any user of these platforms has a double liability: first, to your country's law, second to the bug bounty platform's policy.

In the case of #HackerOne, they delegate this policy to the vendors:
"Security Teams will publish a program policy [...]. You should always carefully review this program policy prior to submission as they will supersede these [H1's] guidelines in the event of a conflict."
Source: https://www.hackerone.com/terms/disclosure-guidelines

So vendors can create a policy "no one is allowed to publish if we don't agree" and defeat responsible disclosure. In fact, some vendors do exactly that. Bug bounty platforms are paid by vendors and have no incentive to protect the researchers.

➡️ If you submit your vulnerability via email or similar directly to the vendor, then you are not legally bound to the bug bounty program's policy.
➡️ If there is trouble, involve your national CERT, they truly mediate.

Stay safe and warn your pentesting friends.

#PenetrationTesting #CVE #ResponsibleDisclosure

#introduction

Hi,

I am an #infosec enthusiast interested in #dfir #incidentresponse #malware #rootkits #velociraptor #reversing and a bit #pentesting / #purpleteam (yeah, bit more on the #blueteam side... 😅 )

Programming wise #linux #python #rust #golang

Apart from that I can always talk about #rock and #metal 😀 🤘

Looking forward to connect to people on these topics - feel free to PM me 🙂