Calling it "Modified" MIT is just misleading.

But it turns out, all the major IDPs support OIDC now. It's a non-issue.

"Ex-Intel executives raise $21.5 million for RISC-V chip startup":

https://www.aheadcomputing.com/

I believe the founding team is all in Oregon - and mostly all ex-Intel.

Comments URL: https://news.ycombinator.com/item?id=42995820

Points: 4

# Comments: 1

https://support.okta.com/help/s/article/overview-of-enhanced...

2024-07-23 - Vulnerability introduced as part of a standard Okta release

This issue is not an "okta is old" issue. this was new code written in 2024 that used a password hashing function from 1999 as a cache key.

it's all volunteers/open source, but this isn't an ASF project.

Comments URL: https://news.ycombinator.com/item?id=40518128

Points: 7

# Comments: 4

Wondering HNs collective wisdom on this-- at work we've been using Access Controls on our homepage for awhile- https://www.conductorone.com/ - to the people outside the IAM-geek space does this make more sense?

This fork also implements Redis Client Pipelining to check multiple limits at the same time, and Concurrency Limits.

https://pwnedkeys.com/submit.html

Which if you had an standardized representation of that attestation, maybe CAs could consume that instead.

But, the author of pwnedkeys thought of that, and started an RFC for exactly that:

https://github.com/pwnedkeys/key-compromise-attestation-rfc/...

But it seems dead right now.

It made it debuggable via output if needed, but the primary consumption became span oriented.

I mean it seems like its clearly a key that wasn't in an HSM.. and over the lifetime, hundreds? Thousands of Github employees could of accessed it?

https://lwn.net/Articles/637156/

I'm honestly not familiar with anyone actually using host-key rotation?

Comments URL: https://news.ycombinator.com/item?id=35086917

Points: 4

# Comments: 1

three questions / thoughts:

1) Your post mentions "Ranking", and while do the most impactful work first is great, the method I have most often used is when dealing with Vuln-overload is to "Reclassify". That is Common Vulnerability Scoring System (CVSS) (super flawed as it is) has let reporters check the box for "remotely exploitable" therefore its a 8.0 HIGH vulnerability -- but I think your product could let me reclassify the vuln to a medium/low - maybe a built in CVSS score editor?

2) One other thing there should also be a built-in concept of "accepting the risk" -- and ideally a concrete report of what was previously "accepted", and if that package gets used in new ways?

3) I'm curious what you think about market segmentation in this space? Specifically the sub-200? person companies seem to be using alot of the "all in one" Compliance platforms (eg, Vanta, Drata, etc). Vanta for example does have a vuln management + SLA tracking dashboard + ticketing tools.

Other thought I had, is there any concept of expiration of permissions?

Something I ran into when I used to do more Apache Software Foundation work was that, we had thousands of committers with shell access -- but 94% never used it. Are any of the things protected by this privileged? eg, a release private key?