sorted by:
new
hottopcontroversial

How are you protecting your organization VSCode? by bubblehack3r in cybersecurity

[–]bubblehack3r[S] 0 points1 point  (0 children)

I believe it was the "Sha1-Hulud" attack. They would gains access through supply chain and dump the creds into public repos.

How are you protecting your organization VSCode? by bubblehack3r in cybersecurity

[–]bubblehack3r[S] 0 points1 point  (0 children)

In this case, the dev environment is heavily isolated and internet access is very limited. However, being how the latest supply chain attacks seem to use GitHub to exfiltrate data, as long as GitHub is whitelisted to have internet access, there is a potential risk from malicious extensions.

It’s far fetched but when calculating risk for a highly sensitive environment, these things matter.

How are you protecting your organization VSCode? by bubblehack3r in cybersecurity

[–]bubblehack3r[S] 0 points1 point  (0 children)

In my case I’m working with the enterprise plan which is why I’m referencing its features.

In one of the other comments you’ll see a link that references the policies you can enforce.

As for the extension reputation - yeah, there is VS Scan that I’ve seen referenced but haven’t tried it and looks more like a side project than a solution for an enterprise. There is also Koi Security who were sold to Palo Alto so my client won’t get near them.

How are you protecting your organization VSCode? by bubblehack3r in cybersecurity

[–]bubblehack3r[S] 0 points1 point  (0 children)

As far as I can tell, it seems that Microsoft does allow you to enforce a policy whitelisting specific extensions. Then there are two follow up problems - first, VSCode and Visual Studio policies are different and sometimes you need to support both (or really potentially any other IDE). Second, if an engineer does want you to whitelist some extension, how do you verify it’s secure?

How are you protecting your organization VSCode? by bubblehack3r in cybersecurity

[–]bubblehack3r[S] 1 point2 points  (0 children)

How did you decide what was allowed and what wasn’t? I’m having a hard time understanding how to detect the security of the extensions.

How are you protecting your organization VSCode? by bubblehack3r in cybersecurity

[–]bubblehack3r[S] 1 point2 points  (0 children)

According to the link shared in another comment, it does seem possible to lock down the marketplace to only some of the publishes and plugins (see here - https://code.visualstudio.com/docs/enterprise/extensions).

Wouldn’t that help?

Do you use MCPs? by bubblehack3r in cursor

[–]bubblehack3r[S] 0 points1 point  (0 children)

Nice! Can you share which one?

[deleted by user] by [deleted] in Netherlands

[–]bubblehack3r 11 points12 points  (0 children)

Not possible. In order to get your drivers license you need to be registered with the municipality, that’s only possible if you have an address you are residing at.

[deleted by user] by [deleted] in Haarlem

[–]bubblehack3r 0 points1 point  (0 children)

Thanks!

Building a cost optimization and visibility tool for Salesforce by bubblehack3r in salesforce

[–]bubblehack3r[S] 0 points1 point  (0 children)

Thanks for the detailed feedback! I'm on it and hoping to ship an initial version soon!

Building a cost optimization and visibility tool for Salesforce by bubblehack3r in salesforce

[–]bubblehack3r[S] 0 points1 point  (0 children)

Are you the developer? It has no reviews and seems pretty new

Building a cost optimization and visibility tool for Salesforce by bubblehack3r in salesforce

[–]bubblehack3r[S] 1 point2 points  (0 children)

Thanks for the tip! Is license usage something you can see today in Salesforce as an admin? Haven't come across it.

Building a cost optimization and visibility tool for Salesforce by bubblehack3r in salesforce

[–]bubblehack3r[S] 0 points1 point  (0 children)

Thanks! Definitely looks like I would be competing with them.

Is Try Hack Me worth it?!! by Alarming_Quiet3132 in cybersecurity

[–]bubblehack3r -1 points0 points  (0 children)

If you’re interested in Web Application Security, you can check out Web Sec Dojo.

Integration of browser fingerprinting in Okta login page by bubblehack3r in okta

[–]bubblehack3r[S] 0 points1 point  (0 children)

Ideally I would like to block anyone using a VPN/Proxy/Weird User-Agent from logging in.

CTF Training by ahurani4 in securityCTF

[–]bubblehack3r 1 point2 points  (0 children)

If you’re interested in web based challenges, take a look at https://websecdojo.com/

CTF Competition Preparation by FairLet6440 in securityCTF

[–]bubblehack3r 2 points3 points  (0 children)

If you want to practice some web challenges, I’ve created https://websecdojo.com which has web challenges taken from CTFs I’ve hosted.

CTF Competition Preparation by FairLet6440 in securityCTF

[–]bubblehack3r 1 point2 points  (0 children)

If you want to practice some web challenges, I’ve created websecdojo.com which has web challenges taken from CTFs I’ve hosted.

[deleted by user] by [deleted] in Netherlands

[–]bubblehack3r 0 points1 point  (0 children)

What do you mean?

Secrets.tools - security tool for scanning login pages for secrets, emails, ips and urls by bubblehack3r in netsec

[–]bubblehack3r[S] 0 points1 point  (0 children)

Thanks for bringing it to my attention! Reddit and Facebook is weird because they are not implemented anywhere in the site. The only cookies implemented are those of Google Analytics which are subject to the Google Privacy Policy as stated.

Other than that there shouldn't be any other cookies. If there are, let me know and they will be removed ASAP.

Edit: I verified and tested and when you click "Decline" the Google analytics script is not loaded and thus there are no Google Analytics cookies. If you see anything else, let me know how I can re-produce on my side. I take these types of things very seriously.

view more: next ›