And hopefully they get enough people backing up all the work that it takes to quickly keep the artisanal code fresh. Because they are working against bad people using tools to make it easy to find bugs and instantly turn them into vulnerabilities.

The Ars article makes it sound like this has been a secret for a while:

But the New York Times was publicly reporting on this in October of last year...

Also call me skeptical how much the NVIDIA CEO needs to be told that a Chinese business woman might be trying to snoop...

But his output stink
His code not “functional” or “elegant”
What do Code Monkey think?
Code Monkey think maybe manager want to write god damned login page himself

Getting alerts when something goes wrong is kind of important. Mission critical equipment like what a blood bank would have often gets contracts with Service Level Agreements where a tech gets alerted to come fix it before the product goes bad.

Obviously, how they set this stuff up was down right bad. But there can be sane business continuity reasons for electronic monitoring...

That's makes some pretty hefty assumptions, like not having firewalls or separate VLANs for internet connected services. Having strict policies on the DMZ has been best practices for multiple decades...

If you are running in an enterprise, Multi Linux Manager isn't worse than any of the other registration systems, had less issues dealing with it over Red Hat's Satellite.

But if your going with Debian and then enterprise support and updates aren't deal breakers. So then the comparison wouldn't be SLES and would be OpenSUSE Leap which doesn't have any of that registration baggage. So this criticism doesn't really make sense, either community updates servers are either good enough or you need enterprise SLAs and need to register with enterprise servers. And you can even get multi-server management with Uyuni, if you really want that same style and to manage with Salt.

They are still making a damn solid FOSS product that people can ethically feel good about, even if they are perennially having those ups and downs. 8 of those 30 was the bad Attachmate and MicroFocus years, another chunk of that was in the questionable decision Novell days. 8 years of private equity and the decisions have generally been better than the past. So I don't share your pessimism. Here's hoping they can keep all those good engineers and keep a good product.

There's two parts to the answer. First, crypto mechanisms are changing all the time as opposed to how banks transfer money to each other doesn't change that much. So change control in traditional finance is known for it's rigor and bureaucracy.

Second, they are still vulnerable to insider attacks and put a lot of effort into preventing them. It's just not that sage of an observation that Binance obviously messed up in their security design, since they lost billions of dollars.

Getting code deployed quickly, while not giving any permission to touch the systems where they are running is a hard problem. And it's not even a finance only problem. But it's a little more nuanced than they purposefully gave one dude permission to move everything.

If you're actually interested in some of what some of the mechanisms that different finances orgs are using to prevent these attacks, Here's a presentation I saw from Goldman Sachs 7 years ago on enforcement mechanisms on Kubernetes Admission Control (e.g. Here's the rules for what code can run). Warning the presentation is both wildly interesting and drier than overcooked turkey leftovers.

There's been other reported cases where they have you jump on a Zoom/Team call, pretend to have issues and have you download their bad client. Or give a development "assignment" where the git repo has an exploit in it.

This is the same stupid stuff that the North Koreans are pulling every where. Places like GitHub, Red Hat, or BitWarden, the developer's boxes is a juicy weak link. Plenty of stories out there on either malicious interview software or North Koreans just straight up working at organizations pretending to be from somewhere else.

Generally exchanges have Know Your Customer and/or reporting requirements from governments. So the answer is wholly dependent on what exchange, what country, and what crypto. Also remember that for most coins the whole point is that everyone together is keeping track of transfers is a shared readable ledger.

It was a DevOps engineer, so that person had access to the systems that deploy to the servers that do the moving the funds. Obviously their deployment pipelines practices were bad and that is a security failure, but it wasn't like they just gave some random employee direct access to transfer billions of dollars.

If you don't like AI-Assisted code then any Linux distro is problematic. And to not acknowledge that the effort in review vs development change structures.

Likewise on the development side most of the shift is going to be the whole rest of their stack like k3s, Rancher, etc. And so likely wouldn't affect you much on the OS side besides a few SUSE specific things like Zypper.

Debian's good too. But think I'm still pretty happy on a OpenSUSE/k3s stack on my home kit for the time being and don't think this worries me anymore than of the previous org changes.

8 years of that PE company and multiple supporting acquisitions later without having chopped off any parts doesn't support that conclusion.

EQT ownership has been since they split out from Micro Focus 2018. After 5 years they IPO'd, shares tanked and they bought back out to go private again.

And in that time that they've been releasing fully FOSS products with a "product is free, but buy the support" model the whole time. Doing good engineering and made some decent acquisitions to support the product line like Rancher. This isn't the typical private equity story.

They've been PE for 8 years and releasing fully FOSS with a sell the support model the entire time...