I checked too, it’s not a valid public DNS record, so then the question is, does Oktas internal DNS resolve this. Even if it does, how does okta even sit in this? Are they the identity provider for Twitter? Surely even if it’s identity, it’s got nothing to do with content moderation? So many questions.
The messaging around this so far doesn’t lead me to want to follow the fork on production. As a sysadmin I’m not rushing out to swap my reverse proxy.
The problem is I’m speculating but it seems like the developer was only continuing to develop under condition that they continued control over the nginx decision making.
So currently it looks like from a user of nginx, the cve registration is protecting me with open communication. From a security aspect, a security researcher probably needs that cve to count as a bug bounty.
From the developers perspective, f5 broke the pact of decision control being with the developer. But for me, I would rather it be registered and I’m informed even if I know my configuration doesn’t use it.
Again, assuming a lot here. But I agree with f5. That feature even beta could be in a dev or test environment. That’s enough reason to know.
Edit:Long term, I don’t know where I’ll land. Personally I’d rather be with the developer, except I need to trust that the solution is open not in source, but in communication. It’s a weird situation.
Dude, someone corrected your misinformation and you call them a bully?
Just remember to patch. Owncloud has some of the worst possible cves right now.
I’m just going to give you props. I have worked in Managed IT Services for a dozen years and some of the worst clients are construction, engineering and architects who use solidworks, autodesk and archicad products.
You’ve eaten humble pie and admitted that using computers as a tool, and systems design are different and though you might understand a lot, just like I can build a 3d model, the devil is in the detail.
Building robust solutions that meet your business continuity plans, disaster recovery plans, secure your data for cyber risk and to meet ISO and yet are still somehow usable in a workflow for end users is not something you just pick up as a hobby and implement.
The way I handle technology Lifecycle is in 5 steps: strategy, plan, implement, support, maintain. Each part has distinct requirements and considerations. It’s all well and good to implement something but you need to get support when it goes wrong or misbehaves. You need to monitor and report for backups, patching, system alerts. Lots of people might do the implement, but consider the Lifecycle of the solution.
People do these things at home but they’re home labbing, they’re labs. Production requires more.
Anyway a bunch of people closer to your part of the world will probably help you out here.
I just want to again recognise and compliment you on realising and openly saying you want help rather than just do the usual “oh I know best” that I hear over and over usually just before someone gets ransomed on their never patched log4j using openssl heartbleed publicly exposed server infrastructure.
Lol, a thousand hours would be 6 months of full time work (40 hour week). I’m not sure I’d employ someone who has 6 months of IT experience into a systems administrator job and task them to build a an erp/dms/unified coms solution for a client.
But this guy should be able to do it as a hobby?
I ended up reading it on bleeping computer since the linked site looks like an auto tldr bot saved 50% of the words. The important 50% was discarded.
https://www.bleepingcomputer.com/news/security/18-year-old-security-flaw-in-firefox-and-chrome-exploited-in-attacks/