phishing
-
-
Waymo objects to foundation but Janosko already said "yes" so we're moving on
Afficher cette discussion -
UBER: As of last year, your group didn’t have any involvement in the protocols of the SVN server, is that true? JANOSKO: So... [begins to talk] Alsup interrupts and says he's not being fair to Mr. Gonzales and he should answer
Afficher cette discussion -
UBER: There's such a thing as a staaale user, right?
Afficher cette discussion -
One way to deal with stale users is to revoke credentials
Afficher cette discussion -
If a stale user doesn't log on for many months, then "you don't know that the user's credentials would be revoked, do you?" Janosko's answer is that "there are procedures in place"
Afficher cette discussion -
UBER: If someone didn’t use it for three months, you wouldn’t know if they expired, would you?
Afficher cette discussion -
Janosko goes back and forth before Uber pins him down with "you wouldn't know one way or the other, would you?"
Afficher cette discussion -
One of my favorite things is seeing depo tapes versus witness on the stand and how much trial prep has gone into them
Afficher cette discussion -
we're playing a depo tape right now and whew Janosko has gotten a lot of prep eh
Afficher cette discussion -
There's 750 people on the security team. Uber pressing Janosko asking "WHO!!!" is responsible for keeping an eye on the SVN to see if anyone is downloading "all the files"
Afficher cette discussion -
UBER: Is ANYBODY in charge of supervising that! JANOSKO: I don't know if downloading all the data on the SVN server is necessarily a malicious act, it's what they do after that.
Afficher cette discussion -
Alsup intervenes. Asks if he knows anyone and to give a specific name. Janosko does not know.
Afficher cette discussion -
UBER: [extremely darkly] Are you aware of any server that downloads ALL OF THE DATABASE when you log in
Afficher cette discussion -
Back to Waymo, Waymo establishing that SVN is hosted in Cloud, Google Cloud has all the security protections described
Afficher cette discussion -
Janosko is done, we're going to take a 15 minute break bc alsup is sick of this shit lol
Afficher cette discussion -
Sasha Zbrozek now on the stand! That's the engineer that was like "idk guys is this really a big deal tho"
Afficher cette discussion -
-
oh my goddddd he just spelled his last name using phonetic alphabet
Afficher cette discussion -
-
Waymo asks how SVN works. ZBROZEK: We will download the entire repository, usually the present-day snapshot, we'll upload it back with whatever we've changed.
Afficher cette discussion -
ok guys you can stop getting mad about svn in my mentions now
Afficher cette discussion -
Zbrozek set up the SVN in question and wrote the documentation for using it
Afficher cette discussion -
WAYMO: What is yak shaves dot com ZBROZEK: It was the SVN server WAYMO: Is that still the domain? ZBROZEK: No, not anymore. WAYMO: Why did you change it? ZBROZEK: Once it became public it was necessary to get it changed.
Afficher cette discussion -
I regret to inform everyone that yak shaves dot com currently redirects to one of my tweets
Afficher cette discussion -
Zbrozek is the same engineer who said in an email that Levandowski's downloaded files were "low-value" and said that he didn't want to set a precedent for a full repository download to be suspicious
Afficher cette discussion -
for the last time, i know what yak shaving is, it's still a stupid fucking domain name
Afficher cette discussion -
Zbrozek's full email: Well, Anthony’s log speaks to the number of files. It also expresses the (rough) file size for each transaction. Figuring out the totals for both can be done by parsing the log snippet. +
Afficher cette discussion -
I’m a leery because both of those numbers aren’t really meaningful to any narrative. It also has a chilling effect on being a hardware engineer -- we all do full checkouts and it makes me uncomfortable to think that lawyers are trying to ascribe suspicion to it.
Afficher cette discussion -
WAYMO: You said it didn't ring any alarm bells to you, does the information on the screen ring alarm bells to you? (the screen is a demonstrative from the Google forensic side showing where the full repo went -- to a SD card etc) The question was not allowed
Afficher cette discussion -
Now going to the "it was considered low-value enough" email. WAYMO: What did you make of that?
Afficher cette discussion - 55 réponses de plus
Nouvelle conversation -
Le chargement semble prendre du temps.
Twitter est peut-être en surcapacité ou rencontre momentanément un incident. Réessayez ou rendez-vous sur la page Twitter Status pour plus d'informations.