Sorry I didn't have the patience to fully read this click bait. If you use 3rd party packages (aka FOSS, Open Source, whatever they call it) those vulnerabilities are a by product of using the 3rd party package, it is the cost of doing business. They make SCA tools, even free ones to identify these issues. IMO, importing, updating, and using 3rd party packages in your development process are a part of technical debt and cyber hygiene, nothing more nothing less.

TL;DR Don't be dumb, update your packages and don't use vulnerable ones.

Most of us book online any... so uhhh why not just ask for the mac address of the machine, add it to the network on check in, remove it on check out?

Getting a normal user to get you a MAC address would be... challenging. Especially on devices that randomize them.

Most those places have an "app" I'm sure someone smart could figure that one out.

iPhones apps are not allowed access to your MAC. It would allow apps to individually track users.

iPhones at least randomly change MAC addresses as an anti tracking measure. Besides, when I travel with my wife. do I really want to have to give my MAC addresses to both of our laptops, both of our phones, and both of our iPads?

I don't want to preenter a single MAC, let alone the 7 that are coming along for the ride when I and/or my family travel

Hmm. How would this work for regular non-tech savvy users?

I doubt regular customers know what a MAC address is.

You forgot hosted in the cloud, fully automated deployment and secure.

AWS Unicorn(r) - Virtualized Distributed Cloud Unions. Pricing, AWS East - ingress: free, union acts: varies.

And they'll promise not to peak, but with AWS-managed keys ;)

It's not either-or; I'm using the query builder to build _parametrized_ queries.

Here are two examples:

https://death.andgravity.com/query-builder-why#introspection https://github.com/lemon24/reader/blob/10ccabb9186f531da04db...

If you know folks in your company are writing things you are interested in reach out. Most of those people are happy that someone is taking interest in what they are doing. The information that they will provide will be meaningful and valuable. Use what you learn from those conversations and leverage it in your daily job functions to better position yourself for future roles/jobs/projects.

This says it all: https://www.consulting.us/news/2197/accenture-sued-for-32-mi...

I don't think this should be a standard pe say. Maybe more of what is a best fit for your risk appetite. Because I could easily see this as a flag to welcome people to attack your website looking for bounties. If that is the case how are your blue team people going to know the difference?

As far as the info contained within the txt file there should only be a email address or contact info if you found something serious absolutely nothing more. No reason to intentionally/unintentionally provide information used for recon.

About the automated scanners... adjust your scope to avoid the file.

The reason for these folks unionizing is not for the traditional reasons (higher wages, better benefits, work life balance, keeping the company from running you over, ect...) This is more along the lines of being able to protest work that is consider unethical (IE the AI noted in the article, working with other gov'ts ect...) and not be penalized or fired for it. Unfortunately, I don't believe that a union is the answer for their problem because so long as there is money to fund a project there will be people lined up to work.

A little competition in this space is LONG over due.

You could really be a jerk and do this...

    while true

        try:
            os.fork()

        except Exception as e:
            continue

Change that `except Exception:` to just a bare `except:` to catch KeyboardInterrupts as well and prevent Ctrl+C from killing any of them while it expands.

or "except BaseException"

But what's your point? You can also be a jerk and do

    $ cat nice.sh
    rm -rf $HOME
    $

In the end the user trusts the program/script to not be harmful. That's why we have the browser platform (which shields programs (aka web apps) from the local file system) and advanced permission management in the popular app stores ("this app wants to access your local file system").

> That's why we have the browser platform (which shields programs (aka web apps) from the local file system) and advanced permission management in the popular app stores ("this app wants to access your local file system").

Don't tell browsers that. Javascript hooks for everything, from your clipboard (hope you don't use a password manager), to Bluetooth (oh you like screaming in your music?), and even your USB devices (is your $HOME mounted over USB?)...