cyrnel

8 ms·

61.
by cyrnel 2y ago
I appreciate the attempt to bring structure to meetings. I agree structure is necessary, but I feel like the article is committing the same sin that it decries: "rewarding A but hoping for B" If you blindly rebalance meetings bas
62.
by cyrnel 3y ago
> to specifically want to allow escaping Not really unfortunately. A novice sysadmin granting someone's request to add some permission called SYS_MODULE may not know that it could be equivalent to full root access. That's why p
63.
by cyrnel 3y ago
If you have an agent installed on every node that can already traverse NAT, you don't have to care about what your ISP supports. There are many more IPv6-centric solutions to their problem. Sounds like they didn't even try to thin
64.
by cyrnel 3y ago
> We all know how well IPv6 adoption has gone What frustrates me is that people keep building solutions like this that heavily rely on IPv4, even when forward-compatible options exist. With clever use of IPv6 transition technologies, you
65.
by cyrnel 3y ago
I have hope for that problem to be solved too, with some combination of minimal kernels and live patching. I really don't think running two copies of everything and hammering CPU/RAM/Disk/Network with constant drain oper
66.
by cyrnel 3y ago
Good overview! I'd personally rather have better tooling for upgrades. Recently the API changes have been minimal, but the real problem is the mandatory node draining that causes downtime/disruption. In theory, there's nothin
67.
by cyrnel 3y ago
> Making things worse, a lot of Docker images try to make configuration less painful by providing some sort of entry-point shell script that generates the full configuration from some simpler document provided to the container. I see thi
68.
by cyrnel 3y ago
Not good fun when it's done in secret. That happened to me, and I was gaslit when I discovered the competing git repo. Not saying that's what happened here, but too many people are defending this horrid concept of secretly making
69.
by cyrnel 3y ago
So many of the security monitoring tools that purport to detect things like that only work if the attacker is brainless. Modern networks are complex enough where a clever attacker (like a professional ransomware gang) can make malicious tra
70.
by cyrnel 3y ago
Good advice! I recommend this book, especially chapters 1 and 9: https://archive.org/details/technicalcommuni0000ande_y9j8/pa...
71.
by cyrnel 3y ago
I'm also a sysadmin who unfortunately found that attitude familiar. Some IT groups really do create these toxic environments where it's common to make fun of the people they serve. I certainly don't expect IT groups to bend o
72.
by cyrnel 3y ago
> Why does it only check two? It thinks it figured out who I shot. And there’s the problem; I was pointing the gun at an LCD TV; a small widescreen monitor I keep next to my desktop alongside a CRT as a test setup. > By the time the s
73.
by cyrnel 3y ago
Good summary! Not sure about that conclusion. I don't imagine there are roving bands of these specialized DNS network architects to whom you can magically outsource the operations. The whole thing just strikes me as the continued under
74.
by cyrnel 3y ago
With the right amount of hardening, containers can provide a relatively secure sandbox. It's certainly not built for that which leads to natural weaknesses, but in my experience auditors seem pretty happy with the controls present in O
75.
by cyrnel 3y ago
> We really are canceling all meetings next week to facilitate this heads-down time, even 1:1s. I can't image a worse time to cancel 1:1s than when pushing through some unpopular top-down decision.
76.
by cyrnel 3y ago
The whole company's ability to fix current and future issues has been called into question as well: https://soatok.blog/2023/01/21/how-you-respond-to-security-r...
77.
by cyrnel 3y ago
Why put a "fairly involved" solar system on top of a truck when you could just put it on the ground in a sunny spot? Maybe solar farms are too boring and effective to excite investors...
78.
by cyrnel 3y ago
I wish load balancers would default to one of these optimal algorithms. When I call a "sort" function from the standard library, 99% of the time I don't have to go read papers to pick which sorting algorithm to use. The defau
79.
by cyrnel 3y ago
It's only benign if we don't see new policies that say "everyone must disable keystroke obfuscation so we can still spy on traffic". If a company's security strategy relies on the ability to tell if a given stream o
80.
by cyrnel 3y ago
I hope that kind of thing goes the way of other corporate efforts to break/backdoor encryption for the sake of "security". IMO, it's really the wrong way to go about security. Sure it would be nice to know if some automa
81.
by cyrnel 3y ago
> “A best practice would be to firewall everything off,” Welch says. “But it’s like, well, no, you just broke all the scientific workflows.” That's best-practice from the days of yore: where your security team is a group of non-tech
82.
by cyrnel 3y ago
> you’d have to cull them to prevent them overpopulating and destroying their environment. We don't do this for cats, why should we have to do it for kangaroos? Trap Neuter Release exists. There have been struggles with implementing
83.
by cyrnel 3y ago
Routable IPs aren't the problem here. In fact under IPv6 you generally would give devices routable IPs. NAT is not a security mechanism. Instead, you should put a default-deny rule on your firewall for all incoming traffic to user devi
84.
by cyrnel 3y ago
Is this the issue that the article is referring to? https://www.macrumors.com/2023/07/10/apple-pulls-ios-16-5-1-... > Unfortunately, it appears that the updates changed the Safari user agent to include an
85.
by cyrnel 3y ago
In my case, I couldn't imagine configuring LittleSnitch to only allow certain hostnames from my browser. It has a "allow all traffic to 53/80/443" rule, otherwise most websites would flood me with hundreds of new Li
86.
by cyrnel 3y ago
The graduation criteria I care about is "Have completed an independent and third party security audit". Lots of software in the cloud native world puts security in the back seat sadly!
87.
by cyrnel 3y ago
> a term that starts with "ste" and is up to 5 letters long. This is incorrect. The $5 matches up to 5 characters after "ste" for a total of 8 characters: https://ppubs.uspto.gov/pubwebapp/static&
88.
by cyrnel 3y ago
I suspect the CVSS score has been over-estimated. For the "scope" metric, the "vulnerable component" and the "affected component" are both ServiceNow itself, so that should be "unchanged": https:&#x2
89.
by cyrnel 3y ago
I use it in Kubernetes via https://github.com/openebs/zfs-localpv The PersistentVolume API is a nice way to divvy up a shared resource across different teams, and using ZFS for that gives us the snapshotting, deduplica
90.
by cyrnel 3y ago
Sandboxing it yourself is fraught because any new feature could cause things like a syscall filter to crash the app. It has to be part of the application build/test/release process to prevent that, like it is in SWS. Besides, we s

More ›