Tag Info

New answers tagged

1

I think the security threats come from a few places: Data accessed by IFTTT. An attack can happen in transit, in memory, or in storage (for a security evaluation I'll assume that IFTTT stores all data it accesses). Accounts and devices connected to IFTTT. While you're recipes may not access sensitive data, if IFTTT has access due to mobile app ...


1

It is really important that you provide viable alternative solutions and not just rely on arguments that it is a bad technical solution. For example, could using a VPN setup be a better choice rather than re-developing the code to use a non-privileged user? Can you generalise the solution? For example, would a VPN solution provide increased and more secure ...


14

That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. hijacked server code) without bringing down the whole machine. This is the mainframe model from a few decades ago. At that time, it was believed that you could ...


3

You might try demonstrating server problems that occurred in well-tested servers and make the claim "If after all of the testing and examination they were insecure, how can we expect to do better?" The first example that pops into my head is the Shellshock bug. When combined with CGI from the Apache Web server, it allowed remote execution. This was not due ...


8

Frankly, the relevant words are "custom code running as root and exposed to the Public." To justify the coding effort and delays, you will have to do some quick calculations on the impact of the code being exploited and a malicious actor gaining root access to the server it is running on. If the cost of a breach is more than the cost of the coding effort ...



Top 50 recent answers are included