• 0 Posts
  • 268 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle













  • Oof, that was painful to read as someone in cybersecurity. I respect ProPublica, but they have no idea what they’re talking about.

    The Solarwinds hack was caused by Solarwinds being absolutely god awful at cybersecurity. The password to their update server was “solarwinds123”, which we know because they accidentally published it in a public Github repo. The company is a complete and utter clown show.

    As for Golden SAML, almost nobody in cybersecurity would consider it a vulnerability. It’s just a fundamental part of how asymmetric cryptography works. HTTPS suffers from the same issue. If your private key gets stolen and used to forge signatures, the problem is you not properly protecting it, not the technology requiring you to keep it secret.

    A more valid complaint is that Microsoft has been neglecting their on-prem software in favor of Azure. There are tons of security features that they’ve added to Azure that will probably never make their way to ADFS or Exchange.