undefined | Better HN

0 pointsdcow4y ago0 comments

Yep, while the downside is that it wastes maintainers’ time and they are rightfully annoyed, I find the overall topic fascinating not repulsive. This is a real world red team pen test on one of the highest profile software projects. There is a lot to learn here all around! Hope the UMN people didn't burn goodwill by being too annoying, though. Sounds like they may not be the best red team after all...

0 comments

kemonocode4y ago

A good red team pentest would have been to just stop after the first round of patches, not to try again and then cry foul when they get rightfully rejected. Unless, of course, social denunciation is part of the attack- and yes, it's admittedly a pretty good sidechannel- but that's a rather grisly social engineering attack, wouldn't you agree?

TheSpiceIsLife4y ago

A real world red team?

Wouldn't the correct term for that be: malicious threat actor?

Red team penetration testing doesn't involve the element of surprise, and is pre-arranged.

Intentionally wasting peoples time, and then going further to claim you weren't, is a malicious act as it intends to do harm.

I agree though, it's fascinating but only in the true crime sense.

brobdingnagians4y ago

Totally agree. It is a threat, not pen testing. Pen testing would stop when it was obvious they would or had succeeded and notify the project so they could remedy the process and prevent it in the future. Reverting to name calling and outright manipulative behavior is immature and counterproductive in any case except where the action is malicious.

j / k navigate · click thread line to collapse