Daniel Beck

Working on @jenkinsci for @cloudbees. He/him.

[Daniel Beck @danielbeck]

@JLLeitschuh That's how I interpret "If it is before the Publication Date, but the vulnerability is observed under active exploitation, it moves to the 0-day policy (above)". There's no waiting period for this case, making it more aggressive than if it's exploited first, then reported. Why?

[Daniel Beck @danielbeck]

@JLLeitschuh Say you report something today, 23rd.
Scenario 1: Known exploited already, then reported, scheduled publication on the 30th.
Scenario 2: You only notice exploitation on the 30th or later. Publication immediately, no time for vendor to react after scheduling for 90 days.

[Daniel Beck @danielbeck]

@JLLeitschuh If exploitation is observed more than 7 days after notice date, does that mean immediate publication? Seems a bit much. What justifies waiting 7 days if exploitation is observed before reporting, when you wouldn't afterwards?

[Daniel Beck @danielbeck]

@M_haggis FYI it's not that easy: the advisory also mentions the WebSocket endpoint for the CLI you don't seem to identify, there's the opt-in SSH port for CLI, plus more obscure HTTP request routing in Jenkins leading to the CLI https://t.co/MOCPVIeTBN

[Daniel Beck @danielbeck]

@YNizry @cyb3rops That doesn't give a complete picture due to the many ways objects in Jenkins can be accessed via different URLs (that's why the workaround looks like it does). I was looking into potential URL filtering as a workaround and couldn't get to a reasonable state for publication.

[Daniel Beck @danielbeck]

@YNizry @cyb3rops That doesn't give a complete picture due to the many ways objects in Jenkins can be accessed via different URLs (that's why the workaround looks like it does). I was looking into potential URL filtering as a workaround and couldn't get to a reasonable state for publication.

[Daniel Beck @danielbeck]

@monkchips @rchrdbyd Each event has an associated (and configurable) time zone visible when editing it. Looks like by default it's the event creator's primary TZ.

[Daniel Beck @danielbeck]

@Mengu09 @Oceansoul921 Even worse: 35 + 35 int'l shipping per set since BRO + import tax etc. Plus probably a handling fee from Fedex of 15-20 EUR (at least before BRO). Oh, and they suck at packaging, so expect the highest numbered mythics to be damaged. And some cards may be missing.

[Daniel Beck @danielbeck]

@oleg_nenashev @CDeliveryFdn CDF Slack isn't useful if you want to look up anything older than 90 days. Even IRC allows for client-side logging.

[Daniel Beck @danielbeck]

@JM_Meessen @NetApp @jenkinsci Looks legitimate (sort of). I know these emails from elsewhere as well, but at least there's a customer relation there. Someone at NetApp probably put the Jenkins security team email address as vendor contact when they asked for a Jenkins instance to be set up, and here we are.

[Daniel Beck @danielbeck]

@exempli_G Could you provide an example of that? The only reason I can think of that this would happen is if you mutate the `env` global variable.

[Daniel Beck @danielbeck]

@sag47 @jenkinsci When in doubt, always file SECURITY issues. Opening up afterwards if appropriate is easy. Note that @wadeckfollonier is now running the show.

[Oleg Nenashev @oleg_nenashev]

The awesome @CloudBees security team is looking for an engineer to work on @jenkinsci. Java, JavaScript, Docker, K8s, CI/CD, security tools, etc. Join @danielbeck, @wadeckfollonier and @jvz!

https://t.co/FdYTQpZCzj

[Daniel Beck @danielbeck]

@ses_unifr @ManuelPuppis @dcm_unifr @diana_ingenhoff @illial Lernt man als "Master in Kommunikation" auch, wie man Veranstaltungen zum Thema "wie im digitalen Zeitalter kommuniziert wird" bewirbt, ohne die falschen Accounts zu taggen?

[Daniel Beck @danielbeck]

@BenMack The part where it says I'm located in Germany.

[Daniel Beck @danielbeck]

@BenMack @GuRuth @SethAbramson Obviously not, which you'd know if you had looked at my Twitter bio.

[Daniel Beck @danielbeck]

@Magical__Hacker @BudgetCommander Got it slightly wrong earlier: CR 802.2 says in a Commander game all opponents become defending players. CR 802.2a says abilities like this one that reference "defending player" need to have one chosen. So the ability works (and bonus: Doesn't have to be the player you attack).

[Daniel Beck @danielbeck]

@playtowinmtg What's more casual than everyone at the table casting a single overcosted spell each turn?

[Daniel Beck @danielbeck]

@agentdero Best doesn't mean good.

[Daniel Beck @danielbeck]

@bas_van_schaik Re github/codeql, I see two blockers: The Jenkins ecosystem is probably too small to warrant inclusion; and the way Stapler works means we'd potentially generate tons of false positives in other projects. The latter might be doable by filtering based on pom deps, but unsure how.

[Daniel Beck @danielbeck]

@bas_van_schaik Thanks for the kind words. The queries will be open-sourced in some manner once maintainers of publicly available plugins had a better chance to get started fixing their stuff (and I had some more time to reduce false positives further).