It itself is not FOSS, but Network Chuck just had a decent video on setting up ThinLinc for his editing team. I believe it is free for ten or fewer users. There is an admin function that allows you to observe what another user is doing (session shadowing).

https://m.youtube.com/watch?v=qdo5lMR1lX4

In general, for native FOSS, I’m pretty sure you can specify the screen port in VNC, and connect multiple users to the same port, but you’d have to double check the configuration file. Can likely also be done with XRDP.

TL;DR: Cofounder of open source project says super popular platform using their project needs to pay up for inane reasons. Chaos ensues.

In summary:

WP Engine is one of the most popular third party platforms built on top of WordPress.

They have a link and images on their webpage referencing that they are built on top of Wordpress (this is legal).

The former cofounder of Wordpress said that they are illegally using the Wordpress trademark.

WP Engine sends Cease and Desist.

WordPress Cofounder doubles down, blocks WP Engine and demanded WP Engine pay licensing fees for using their branding.

This pissed off a lot of people.

WP Engine sues. For a lot, including extortion, abuse of power, and asserts the cofounder of WordPress has criminally made false statements to the IRS.

The Executive Director for Wordpress resigns, presumably in solidarity with WP Engine and the community.

You know the Internet didn’t die, right?

Said it better than I could. Fair? Yes. Effective? No.

So… Slackware?

Most ransomware groups are in NK, Russia, or China… UTC+8. US East Coast is UTC-4, West Coast is UTC-7. Do the math— this is just business hours for them.

It’s not like the malicious actors have stopped looking… If they are finding fewer vulnerabilities, it sounds to me they should be paying more.

Actively encouraging people to toss perfectly good hardware to fuel their subscription bullshit… and these guys weren’t even recently bought by a VC firm or anything?

That’s a penis dot gif

Metroid prime pinball was incredible, especially with the use of the rumble pack. Underrated accessory for the DS.

You farm the remaining humans like livestock? We mastered factory farming 100 years ago, no reason things need to change just because the animals can talk back.

(banned from /c/veganism)

Yeah, no shit, you’re the fucking CEO

This is nothing new, other than that Chase has brought this capability in-house. Credit card companies have shared purchase information with second parties forever.

Chase Media Solutions follows from the integration of card-linked marketing platform Figg, which JPMorgan Chase & Co. acquired in 2022

From my understanding, the impetus was that F5 submitted a CVE for a vulnerability, for an optional, “beta” feature that can be enabled. Dounin did not think a CVE should be submitted, since he did not considered it to be “production” feature.

That said, the vulnerability is in shipping code, regardless of whether it is optional or not, so per industry coding practices, it should either be patched or removed entirely in order to resolve the issue.

If they are also sending a validation email, it would fail, so no issue.

You can improve output by 10% by replacing that one bamboo with sugarcane. Other than that, just tile the design.

1. From the title of your article and your executive summary, the premise of your paper is that CVSS is flawed, and CITE is your solution.
2. From the title of your article, and choice of name, “QHE CVSS Alternative; CITE”. CVSS is a VULNERABILITY Scoring System. CITE, as your propose, is a THREAT evaluation tool. You can see how one could have the impression that they were incorrectly being used interchangeably.

As you yourself stated, CVSS does exactly what it says on the box. It provides a singular rating for a software vulnerability, in a vacuum. It does not prescribe to do anything more, and it does a good job doing what it sets out to do (including specifically as an input to other quantitative risk calculations).

Compare what with attack?

Your methodology heavily relies on “the analysis of cybersecurity experts”, and in particular, frequently references “exploit chains”, mappings which are not clearly defined, and appears to rely on the knowledge of the individual practitioner, rather than existing open frameworks. MITRE ATT&CK and CAPEC already provide such a mapping, as well as a list of threat actor groups leveraging tactics, techniques, and procedures (e.g., exploitation of a given CVE). Here’s a good articlewhich maps similarly to how we operate our cybersecurity program.

I think there is a lot on the mark in your article about the issues with cybersecurity today, but again, I believe that your premise that CVSS needs replacing is flawed, and I don’t think you provided a compelling case to demonstrate how/why it is flawed. If anything, I think you would agree that if organizations are exclusively using CVSS scores to prioritize remediation, they’re doing it wrong, and fighting an impossible battle. But this means the organization’s approach is wrong, not CVSS itself.

Your article stands better alone as a proposal for a methodology for quantifying risk and threat to an organization (or society?), rather than as a takedown of CVSS.

You can always reflash it with your own if you hold that concern.

Glancing through your article, while you have correctly assessed the need for risk based prioritization of vulnerability remediation and mitigation, your central premise is flawed.

Vulnerability is not threat— CVSS is a scoring system for individual vulnerabilities, not exploit chains. For that, you’ll want to compare with ATT&CK or the legacy cyber kill chain.

Release date, 06/30/2024. Cease and desist date, 01/01/2024.