Infrastructure & located in the woods mountain biking when not computing. Metal, guitars, and coffee.
Threat model*. Can I haz ability to edit?
Prikaži ovu nit
People ask me why I still use Apache and I consult the Zerodium payout table. 500k for Apache vs 200k for nginx. My threat modem is how much 0 day is worth on a platform.pic.twitter.com/nFaXYJhExw
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
That's really just saying "I use it because everyone else uses it" though :P
-
Apache > nginx
- Još 1 odgovor
Novi razgovor -
-
-
@0xdade it isn't just number of users. It is also the anticipated amount of effort required to actually find an exploitable vuln -
But the way zerodium pays out is based on how many of their customers purchase the exploit from them, which to me says "we pay up to this much because there are a lot more apache servers than nginx servers, so it's more likely to be desired"
- Još 2 druga odgovora
Novi razgovor -
-
-
But since you have TLS enabled the OpenSSL RCEs for a mere 250 K$ gets you either way, alas.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
I think everybody else replying missed the joke. Letting you know don’t worry, I got it
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Real talk, wonder if the price for php is gonna shoot up now that php 5 is EOL and RCE is basically a forever bug unless you pay for a 3rd party to patch
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
lol, but tbf Caddy isn't even on the table, and it's not because Zerodium's loaded with 0days. The same reason could be explain nginx's lower payout
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Maybe it's $500k for Apache because high value targets are running more established software (note same payout for IIS). Perhaps nginx is more secure but there's less demand for it because people running nginx are only worth $200k? We should do drunk history but on 0-day prices
-
And by that I mean just yell about why things are worth what they are. Bonus round: justify bug bounty payouts
Kraj razgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.