Loading…
12
The security guy at my old job said 'you do know that tool calls home, right?' and I think about it every time I install something new
I was at my last job in Sacramento and we were messing with a scanner to check our own web app before a release. This guy Marcus from the security team walked by my desk, watched me run it for like 10 seconds, and just said 'you do know that tool calls home, right?' I shrugged it off because the scan was working fine and nobody had told me otherwise. Two days later our firewall logs showed that thing pinging an IP in another country on every single scan, 40 something times a day. Turns out half the free tools I'd been using for years did the same thing and I just never checked. Now I read the privacy docs and watch the outbound traffic before I trust anything. How do you all vet tools before letting them near prod, do you just sandbox everything or is there a trick I'm missing?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.