Right? I love our neighbors but WHAT

I love the genuine naming scheme for scams like this. If something is genuine it doesn't need to be labeled as genuine. You don't order a "genuine" burger from a restaurant, you don't buy a "genuine" BMW from a dealership, you don't get hired by a "genuine" company...

I have a friend who once brought back an "iPhone" from China for laughs.

Assembled in Mexico?

Huh, who'd of thought Genuine Leather would branch out into the tech industry.

Having the day they paid to have. Beautiful.

Slack working but full of opsgenie alerts.

It has, and I’ve been told “it’s a fluke” or “it’s not worth the effort”, followed by them freaking out with us being down and all the money we’re losing and what can we do about it.

Hasn't us-east-1 had major outages like, multiple times?

My former company wouldn’t let me rearchitect our apps to be regionally redundant because “the cloud never goes down”. All their stuff is in us-east-1… wonder how they’re doing!

OpenVNO telephony despite us being in France.

Also Reddit, it's still a major work tool haha.

So far we've got atlassian and our HR system being broken. But we're mostly CCP and azure for our dev stuff so that's all fine.

Yes and no. The truth of the matter is supply-chain attacks in any repository are almost impossible to fully mitigate. The attack you linked sounds like a big and successful attack, but there are more minor attack attempts all the time. It’s the blessing and curse of every package manager that anyone can upload almost anything.

The upshot is that the most active repos have the most eyes. Not to say an attack won’t fly under the radar, but if the React or Angular packages (or their dependencies) start acting weird, it’s more likely that someone will notice, as there are people dedicated to auditing such things.

Furthermore, a lot of the smaller packages do “one thing” (see the infamous is-even package), so they are small and easy to self-audit if you are paranoid enough.

It’s not perfect, and there will always be more headlines about the next big attack, but it’s still a boon overall IMO.

I think one of the issues inherent to the node ecosystem is that the coast is never clear. When the ethos is to never reinvent the wheel, and instead pull in a dependency chain of thousands of tiny things made by thousands of people (not necessarily a bad thing, it saves time and lets developers focus on what they really want to do), you're going to have supply chain attacks that go undetected, because nobody has time to vet every single change to all those thousands of things.

So I've bought the nanokvm-usb. Why:

• I needed it quickly and was available
• the idea of going through another server for secutiry seemed better: I control the updates and security fixes
• well tested on the internet

the product itself costed around 50€ and I found a used mini pc with wireless connection for 25€

it was easy to install, works fine and is of good quality

looks around

RIP

Was CISA raw-DOGEd? Because this was like a week ago.

In k8s, being able to use things like External DNS and automatically and declaratively manage DNS entries with code saves so much time you won't want to go back once you get used to it.

It takes a while to get your head sorted around it and also to deploy but automagically having your DNS entries, your certificates, et etc sorted feels great.

You hired this guy to do new things, let him do them (as a PoC)

Note that this apparently does work with a 4 port local KVM as well. Technotim, a homelab youtuber, tested them working together smoothly.

So buddy up the above with a jetkvm and you can control 4 systems at once.

The ceo of slack replied to the person from the hacker club in a hacker news thread and cleared it up. They said it was a billing mistake and are continuing their original deal.

This ain't reddit, and everyone starts somewhere.

Apparently subdomains are inadequate, but after talking with some other people and seeing what you guys have to say, I can understand these requirements. He also created a network map, so we are able to better understand it.

absolutely this

CSP is also a possibility, but really you’re talking about an internal attack on your own infrastructure: either by infra teams on your production or devs on your infrastructure (or an external malicious actor able to deploy code)… i think that’s just so unlikely that it’s not worthy of concern unless you’re something like a bank

Sounds like he's already a poor fit, but if you wanted to know why the domains, you should probably ask him. I can't think of a reason.

The cynic in me suspects he might try to run some side job out of your infrastructure.