Vulnerabilities in dependencies used in projects The case of 4Chan never updated any dependencies since 2009 one dependency used was publicly-known to have multiple critical vuln Ghostscript - https://security.snyk.io/vuln?search=ghostscript Local File Inclusion - process pdf files but never checked if the pdf is actually pdf Remote code execution - after injecting. can run scripts on the server The modern wake up call - this event reminded everyone to stay up to date with dependencies updates Dependencies we’re using: mPDF - fixed vuln for versions lower than 7.1.8 deserialization of untrusted data - similar with how 4chan got hacked aws/aws-sdk-php - fixed path traversal vuln for versions lower than 3.288.1 can go back and open directories that are not public arbitrary code execution vuln for versions lower than 3.2.1 Best practices: stay up to date with the tech world join forums like reddit and stackoverflow check websites that publish security reports snyk security - https:/...
As leader, jangan assume orang lain faham communication kita Ciri-ciri komunikasi efektif: Kejelasan make sure objective tercapai kinda like MRT - Measurable, realistic, timebound Kelengkapan 5W1H. why when where who what how Contoh: Tolong buat report tentang umur pengguna sistem A dari tarikh B ke C, dalam bentuk excel, submit by isnin pukul 4. Data ni nk guna utk marketing ke pengguna. Keringkasan Jangan panjang sangat, elakkan ayat berbunga. Straight to the point Kukuh/Konkrit Kena cakap based on bukti/data. Data tak boleh terlalu general, kena specific. Contoh teruk: Ramai kata sistem slow Contoh baik: 17 user dari semenanjung dah comment yg sistem slow pada pukul 8-9 pagi Kesopanan Most of the time kena sopan. Kalau nk push dari comfort zone kena kurang sopan, tapi jangan biadap pulak Ikut scenario Konsistensi Pastikan kalau nk tukar fikiran/arahan, mesti ada justifikasi. Tak semestinya tak boleh kalah, ikut scenario. Feedback Buka ruang persoalan/maklum balas Kena quick to respo...