TXSG8R

Our defense isn’t interested in tackling anybody.

My ass is prepared to take the length. Either Kyle Trask wins the heisman tonight, or we get fucked in the face. I expect the latter.

Fantastic to see him up and talking.

Absolutely, the way gov’t codes for jobs, especially for civil service positions, leads to a lot of very unqualified people in important positions. And with contractors, you’re only as good as the staff that wrote the requirements. That’s why relying on skilled people managing open-source software is a non-starter for the bulk of gov’t IT jobs. There aren’t enough skilled people to run it, and even fewer skilled GS managers to run those teams. They will pay Solarwinds type outfits all the money in the world for turn-key solutions, they don’t have any choice.

I forgot to ask earlier, are those companies transitioning their Solarwinds budgets to code analysis / monitoring for their new open source toys? While taking more of their IT security in house is good on paper, I wonder if they fully understand what they’re are signing up for. Open source isn’t any more secure than an IP product, you’re just signing up for the code security in house, which can be daunting depending on the size of your org/needs. Hence why the gov’t won’t go that route, and Solarwinds will likely keep on rolling with gov’t contracts. As much as they distrust companies, they distrust their IT staff’s competence even more.

Yea, I cant imagine the reaction to stuff like ration books, fuel rations, and scrap drives with our current society. "Patriots" would be front and center leading the charge against the greater good screaming SOCIALISM. Asking Rednecks to swap their big steel brushguards and bumpers for some wood shit for the greater good would probably lead to more deaths than covid.

Yea, I'm a network guy primarily, just got firehosed with RMF as the CyberSec lead for my program so I know more than Id ever care to about all the other controls. I read this like these were sequential events If so, the 2FA exploit occurred prior to the Orion breach, right? I know later on in the article they show how they hit it again during the Solarwinds breach, but it occurred earlier as well?

Those are great questions. Access to that server is still a long leap from them pushing an exploited update out to the world. To tack on, what is their process for creating updates, and what credentials are required for submitting/approving them? How did an update get through their QA process with foreign code? How does external traffic to/from their software not get sniffed and audited to match up with expected traffic and destinations during testing, both internally, and externally during security scans (gov’t has quarterly or monthly scans depending on the org)? Ports, protocols, and services are usually white listed on gov’t networks, so how did this traffic get back to an external control server?

Ironically open source is very hard to get approved on DoD networks (I assume for gov’t networks as a whole, but I don’t have direct experience outside of DoD). As much as Solarwinds is taking a bath on this, there’s a handful of gov’t people that are also going to get ass blasted over this because all of this is pretty black and white in RMF. They either approved mitigations that were faulty, or they fudged risk assessments and vulnerability reporting. Proper defense in depth / layering would also have reduced the impacts of the breaches, which is also a very big deal within gov’t RMF. As much as we laugh about solarwinds123, the bigger issue will be the lax IT dep’t at treasury that gave their “good” admin the keys to everything and his credentials gave the hackers access to the good stuff. Vulnerabilities and exploits are a when, not if. Your cyber security posture should expect them and be designed to minimize the impact and catch as quickly as possible. That’s why I don’t expect the impact to Solarwinds to be as massive as some people are predicting. Microsoft had their 2FA bypassed as well during this breach, and there have been plenty of other IT/tech heavyweights that have had exploits/breaches (how many of us are still using intel chips?). Market share and response will drive how Solarwinds weathers this.

Meh, we will see. Companies hate having to change streams on IT investments due to the cost and infrastructure challenges. I think you'll see plenty hang on just because its the cheaper/easier option, especially if they didnt get hacked. Solarwinds will take a beating, but their market share will probably see them through.

Tangentially, I saw a tweet where a black woman's family was sick with COVID, and that their doctor didn't want her to bring anyone to the ER/hospital until "their lips started turning blue." The replies were amazing, many POC talking about getting similar advice and some doctors chiming in on how to check other areas of the body for signs of hypoxia and links to cheap oximeters so they wouldn't have to guess. I doubt the original doc had any ill intent with his advice, its just a huge blind spot.

It just shows that they aren't any different from the hoi polloi. I think we all know people we can say the same thing about. I have a EE buddy in Huntsville, Alabama. He's originally from Cali, not remotely religious, his strongest link to politics prior to trump was similar to mine. Mostly vote republican because of their support for the defense industry. He's prior military and a gun guy too, but prior to Trump I never knew him to raise any stink about 2A. He never piped up about muh guns during Obama for example. He also used to clown on the religious right. His daughters all swim, one good enough to get a full scholarship at a D1 school and participate in Olympic trials. His best friend is from Boston and leans left. Now, he pops up in my twitter feed constantly yelling at local news sources for anything negative about Trump. He also regularly retweets all the right-wing weirdos now. His best friend tells me that he is still all in on Trump. Refuses to recognize the election, cant admit to any faults or failures by the orange idiot. Its so hard to try to predict who this shit will infect, but once it gets its hooks in it seems like its impossible to break.

Thanks, I always thought cardiac arrest required some kind of intervention, CPR or defrib, to restart the heart.

Can the heart stop momentarily and cause something like this? The reason I ask is because when they carted him off I didn’t see anyone doing any kind of CPR, I think he laid on the court for a couple of minutes before the carted him. Something else I read initially was that when he hit the ground his eyes were open, which is what spooked the hell out of the players. This is all scary as fuck, it’s hard to believe with today’s medical tech a heart condition could still slip through the cracks.

Just saw this. So armchair doctoring, would the medically induced coma and language like "following simple commands" lean more some kind of stroke or would some potential heart issue be treated in a similar way?

Can you lighten the thread page numbers in dark mode? Dark gray on black is tough to see.

It’s concerning that they aren’t updating Keyontae’s condition. They said they flew his family into Tally Saturday and announced he was critical but stable. Silence since then. I hope I’m not reading too much into that.

Its a large leap from having someone compromised within an org installing malware to full on collusion. Insider threats are always a problem. That's what your internal processes are supposed to help you find and/or prevent. Lots of people are going to be called on the carpet to explain how the exploit could be injected and not caught through their internal QA processes. If it was a compromised appliance they could at least point the finger at a sub and/or shipper as a way they injected malware. With it being software, they in theory own that entire chain, so Solarwinds has to eat the entire shit sandwich. Solarwinds will be fine long term. They are a behemoth in the network admin world, but they could have fucked themselves out of gov't contracts for the foreseeable future.

Correct, nothing is impenetrable. The concern is that it started potentially in March and wasn’t caught until now. The autopsy on this is going to be interesting. I’ve read some people are pointing at supply side intervention. I though all Solarwinds stuff was software based, which means someone injected exploit code into their product. Not a good look for a company based around network support to give a state actor a back door into gov’t networks.

Pitts participated in warmups and wasn’t allowed to play, no injuries that anyone has reported on. He didn’t sit anyone else that I know of, but he shuffled the O line around trying to find more balance. Trask had guys in his face most of the night as a result with a 4 man rush.

Fair. As dumb as the Wilson play was, Mullen deserves the blame for sitting Pitts and juggling the O-line in an effort to get better running numbers. The team was clearly looking ahead to the Bama game. That’s on the coaches for not keeping them focused. Sitting Pitts just amplifies the mindset that the LSU game isn’t a priority.

Wilson should probably sleep at a friends place tonight. If he has any left in Gainesville.

Marco Wilson seemed like the next big thing at corner his freshman year. Blew his knee, has been human toast ever since. He’s taken a lot of heat on Twitter and boards over his play the last two seasons. This will help a bunch.

4 man rush and both tackles got absolutely whipped. Mullen deserves a ton of shit for rolling this out on senior night.