raesene9

39 ms·

541.
by raesene9 5y ago
SSRFs are great fun and used on pentests a lot. One of my favourites was where you could hit the cloud metadata service from an application and potentially get credentials back.
542.
by raesene9 5y ago
yeah that's the kind of entry I'm thinking about. I'm hopeful that in the full version they'll explain more detail but it will need that explanation to make it meaningful.
543.
by raesene9 5y ago
Some interesting changes in the Top 10 this time around and in general, I think they're good changes. It does suffer a little bit though from some of the entries being quite wide ranging and non-specific, which I think could leave peop
544.
by raesene9 5y ago
Comparing hardware costs (whatever you might think of how they've done it) doesn't really hit at the problems of running a mainframe and the TCO involved. 1) Single supplier. Have a falling out with IBM.... you're stuffed. th
545.
by raesene9 5y ago
Sure and if you're on AWS you can use their managed offerings. There's a variety of ways of solving it, but it depends on people seeing it as an issue to be solved. I think, unfortunately, what a lot of people take away from &quot
546.
by raesene9 5y ago
common reasons could be :- - Cost, VPNs and the hardware to run them can be expensive - Single point of failure. If you run all your remote access through a VPN gateway then you run the risk of disruption if it goes down. Of course you can
547.
by raesene9 5y ago
Using cosign/sigstore to sign release artifacts https://github.com/sigstore/cosign and instructions for validating signature on download could be a good option here.
548.
by raesene9 5y ago
The NSA doesn't really do a full coverage of Kubernetes security hardening, but does touch on a lot of the same ground as the CIS benchmark. It also covers some areas that aren't in-scope of the CIS benchmark, at a high level.
549.
by raesene9 5y ago
IME podman is optimized for use in Redhat based environment. I've had a couple of odd problems when trying to use it on Debian/Ubuntu. It's not surprising given it's a Redhat project, but it does put me off using it as I
550.
by raesene9 5y ago
If Docker hub went away, I have a fairly strong feeling the sound of CI/CD pipelines collapsing around the world would be heard for quite a while :) Also without paid developers maintaining Docker Engine, there would be a nasty situati
551.
by raesene9 5y ago
Docker begat ContainerD, so without Docker the organization, it would not exist as a project in it's current form. As to current support, well if you're just using minikube, you don't need Docker Desktop, so this isn't a
552.
by raesene9 5y ago
If you just want to build and test images, a Linux VM with the open source Docker engine installed will work fine :)
553.
by raesene9 5y ago
TBF if you know the history of Docker, it seems unlikely that this was their plan in the beginning. Docker started back before the container orchestrator wars and the rise of Kubernetes. They couldn't have predicted that or the popular
554.
by raesene9 5y ago
Podman isn't a replacement for Docker Desktop (the products in question here). Podman is closest in function to docker engine, which is still open source.
555.
by raesene9 5y ago
I've never actually tried installing Docker engine in WSL2... might work I guess :)
556.
by raesene9 5y ago
You can connect to a remote Docker engine instance over SSH, which is easier to setup than exposing the Docker socket over a TCP port. So install the client inside WSL and the engine on a Linux VM. EDIT: https://raesene.github.io
557.
by raesene9 5y ago
It'll be interesting to see how well this works out for Docker, I have a feeling they'll lose quite a bit of custom but convert some to this model. I'd guess a lot of people will just use Docker engine on a Linux VM with the
558.
by raesene9 5y ago
If you want an open source alternative, just use Docker Engine, it's still open source. You can install the docker client inside WSL/OSX and connect over SSH to a docker CE instance.
559.
by raesene9 5y ago
Technically I'm sure that's true, but the number of acquisitions of small software startups the giants make for large amounts of money suggest that they don't view the process of cloning a product as easy.
560.
by raesene9 5y ago
Also not a biologist, but on the point of vaccines and whether they prevent the disease full-stop or just reduce the risk of serious illness, that's covered in the article. My synopsis of that was that it was not expected (by the devel
561.
by raesene9 5y ago
One modern version of this is containerization and container orchestration APIs. Docker/ContainerD/CRI-O etc are basically command execution as a service. Kubernetes is basically distributed command execution as a service. You can
562.
by raesene9 5y ago
This article kind of misses out the later Nokia N900, which had great hardware, but suffered from Nokia's lack of support (IIRC they stopped supporting it about 6 months after launch). If you like that kind of form factor/function
563.
by raesene9 5y ago
Finding go things is a pain (for me) because go is a very general word, I generally use golang to avoid that. Python is easy 'cause the other meaning is a real noun, so disambiguation is easy. Kind is a general word, another tech proje
564.
by raesene9 5y ago
This is only tangentially connected to this specific project, but I'd make the general point of, if you want something to become popular (or expect it to become popular), naming your project is important, and using names that are also
565.
by raesene9 5y ago
And of course before a breach, every company thinks "that won't happen to me". I'm sure that breach was expensive to Equifax internally, but as you say 0 external consequences mean, what company will change their ways...
566.
by raesene9 5y ago
I've been in security in various roles for a while now and what I've found is, in companies where IT is treated as a cost centre and Security say no to stuff, Shadow IT will always be rampant. If you put someone in business into t
567.
by raesene9 5y ago
This it true but I've seen orgs in the past where a business unit would happily pay quite a lot of money to avoid going anywhere near central IT. I think the most extreme example of slow process I saw was an organization where central
568.
by raesene9 5y ago
To me, DevSecOps is mostly about seeing what tests can be done whilst not getting in the way of the development/deployment process too much. That's not a bad thing and there's meaningful security testing that can be done with
569.
by raesene9 5y ago
Although with many clusters, compromising a single node is likely to lead to cluster compromise as it allows for all the service account tokens assigned to workloads running on the compromised node to be used by the attacker :)
570.
by raesene9 5y ago
Out of curiousity, which bits were you thinking of? OPA, Kyverno et all have policies which (AFAIK) hit all the bits of Kubernetes PSS.

More ›