psanford

20 ms·

211.
by psanford 4y ago
In AWS we divide things up into child accounts that roughly match our org tree. Each team or service gets dev, staging, and prod child accounts. Teams have access to their child accounts and its fairly obvious what they all do, or at least,
212.
by psanford 4y ago
> Quota increases can be requested but the default limit tells us what AWS thinks normal usage should be for most use cases. This is certainly not true for a lot of AWS quotas. If you hit an ec2 quota for an instance type, that isn'
213.
by psanford 4y ago
I don't know. I've found it to be pretty difficult to answer the question "which of these 1000 gcp projects are running a production workload and which are random one offs created by a dev messing around or by a google sheet
214.
by psanford 4y ago
I'm not sure I really follow. In an enterprise setting, giving people the option to opt into fido fine and good, but it isn't going to meaningfully help lower the risk of phishing for the organization as a whole. To address phishi
215.
by psanford 4y ago
I don't know the details except that we've been using it since early this year. The docs don't make it seem like there's anything particularly complicated with enabling it[0][1]. [0]: https://learn.microsoft.c
216.
by psanford 4y ago
Nah. Azure AD is one of the few IdPs that already supports FIDO2 Discoverable Credentials. You can use Passkeys with it today. You can go passwordless with it today.
217.
Passkeys(imperialviolet.org)
3 points by psanford 4y ago|0 comments
218.
OCI vulnerability allows unauthorized access to customer cloud storage volumes(wiz.io)
29 points by psanford 4y ago|4 comments
219.
by psanford 4y ago
Vanguard changed their policy when they switched from the u2f javascript api/shim to webauthn. I was able to register non-fido keys with vanguard a few months ago.
220.
by psanford 4y ago
Nice! I'm the author of tpm-fido[1] which is similar to this but with some different goals. It looks like you've implemented ctap2, which has been on my todo list for tpm-fido (we currently use the ctap1 which works fine but doesn
221.
by psanford 4y ago
Chrome has an entry in their FAQ about why this type of attack is specifically excluded from its thread model: https://chromium.googlesource.com/chromium/src/+/master/docs...
222.
by psanford 4y ago
The sqlite cli supports loading modules at runtime, so you can do things like load and use a db via a custom vfs. My Go implementation of this vfs supports running in loadable module mode[1]. [1]: https://github.com/psanford
223.
by psanford 4y ago
I made a similar sqlite vfs in Go[1]. I really love the VFS api. HTTP range queries is about the most mild thing you can do with it. The VFS implementations that use non-traditional backing stores are more fun. Like say, using DynamoDB as a
224.
by psanford 4y ago
Strong disagree. Every "generic" vulnerability scanner still needs some language specific knowledge for how to determine what is an included dependency. The better you want to suppress false positives, the more in-depth knowledge
225.
by psanford 4y ago
What? How does a piece of code that isn't compiled into your binary make you vulnerable?
226.
by psanford 4y ago
> Govulncheck analyzes your codebase and only surfaces vulnerabilities that actually affect you, based on which functions in your code are transitively calling vulnerable functions. This is huge! Every existing vulnerability scanner tha
227.
by psanford 4y ago
I bought a PinePhone to use just as an SMS gateway‡. My requirements is about as minimal as they come: it needs to stay connected to the cell network, wakeup when a new SMS comes in, and run my little gateway server that is listening for db
228.
Cryptographic Agility and Superior Alternatives(soatok.blog)
3 points by psanford 4y ago|0 comments
229.
by psanford 4y ago
My comment was intended to help people who might be in that situation better understand how AMT works, not to justify it. But since you ask, the stated purpose of AMT is to make sure high earning individuals are not using tax loopholes to a
230.
by psanford 4y ago
Its not often mentioned in these threads that you can get what you paid in AMT back in the form of tax credits in subsequent years. Thats worth keeping in mind if you are doing a risk calculation about the probability that the valuation of
231.
by psanford 4y ago
This is a great tip that I use all the time. To be more precise ~ is the default ssh escape character. It is only treated as the ssh escape character if it is at the beginning of a new line. From the ssh(1): > The escape character foll
232.
by psanford 4y ago
EC2-Classic was not its own service. It was a specific configuration of EC2. They retired that configuration by providing a full migration path into a new system that could be configured to perfectly replicate the old system if you wanted i
233.
by psanford 4y ago
AWS doesn't do this. AWS keeps around old deprecated services that they aren't developing new features for, in perpetuity (e.g. SimpleDB). They might not launch that service into new regions, but they will keep it around in existi
234.
by psanford 4y ago
Indeed. Discord also works just fine in a browser where it doesn't have any privileged access to your system.
235.
by psanford 4y ago
Both `.amazon` and `.toyota` both exist and are owned by the respective companies.
236.
by psanford 4y ago
That is totally fair. I will say that I got quite a lot of value from being able to see how tailscale-android works when building my own gioui app[0]. I suspect that being able to see the same thing for a modern iOS app would be useful to s
237.
by psanford 4y ago
Its quite annoying that you can't disable parts of guardduty you don't get much value from. I think the CloudTrail monitoring is quite useful and the VPC flowlog monitoring is basically useless (to me, I have other means of doing
238.
by psanford 4y ago
That not really true. Most desktop environments will create the directories on session startup but depending on the DE that behavior can be disabled (in xfce for example has a service in the session you can disable). It is true that applica
239.
by psanford 4y ago
That is annoying but easily fixed with xdg-user-dirs-update eg: xdg-user-dirs-update --set MUSIC ~/.xdg-user-dir/music
240.
by psanford 4y ago
Attestation certs makes sense for a small subset of enterprise usecases and don't make sense for consumer sites. _In practice_ that is also how WebAuthn is deployed. None of Google/Facebook/Github/Twitter/AWS requir

More ›