raesene9

46 ms·

571.
by raesene9 5y ago
Some useful guidance here, although worth noting that some of it is a bit dated (k8s security can move quickly). Most notably from a scan through, they're mentioning PodSecurityPolicy, but that's deprecated and scheduled to be rem
572.
by raesene9 5y ago
with the usual caveat that it depends on your threat model, I'd say that having separate clusters is likely to provide better segregation. Of course that reduces the benefits of Kubernetes from a cost perspective, and increases adminis
573.
by raesene9 5y ago
I'd say it depends very much on your threat model. Would I trust a Docker container with a hostile multi-tenant setup without additional controls.... no. Is the isolation provided by Docker worth nothing, from a security perspective...
574.
by raesene9 5y ago
If you want to set the filesystem as read only in a Docker container you can do that, without needing to set-up multiple users in the container. In general that's a good piece of hardening advice, you just need to mount an empty volume
575.
by raesene9 5y ago
The advantage of rootless though, over user namespaces with a rootful Docker daemon is that in rootless all the components run as standard user, so a compromise of the Docker daemon should just allow for escape to a standard user. Not sur
576.
by raesene9 5y ago
FWIW you can do that with Docker as well :) Docker rootless went GA in 20.10
577.
by raesene9 5y ago
Interesting how even after this was announced, their market cap is over $5b ( https://www.google.com/finance/quote/NKLA:NASDAQ ) in the same ballpark as established car companies like Mazda ( https://www.g
578.
by raesene9 5y ago
If running containers on Mainframes is of interest, attending this talk at Defcon might be illuminating https://defcon.org/html/defcon-29/dc-29-speakers.html#coldwa... :)
579.
by raesene9 5y ago
I thought Bitcoin was more a store of value (e.g. analogous to gold) than a currency similar to physical cash? If so the problem becomes, is your personal security up to defending attackers who want to take your pile of digital gold.
580.
by raesene9 5y ago
The first named mention of SQLi was 1998 by Rain.Forest.Puppy (AFAICR), however classic ASP did not have any in-built protection from it. I started in security in 2000, as an analyst for an org using classic ASP. maintaining security was a
581.
by raesene9 5y ago
If https://old.reddit.com/r/msp/comments/ocggbv/crticial_ransom... is correct a compentent web application security review (white box or black box) which was correctly scoped to include the affected file
582.
by raesene9 5y ago
Sure so they learn classic ASP in a day, now they have to code their own custom routines for XSS protection, SQLi Protection, SSRF protection etc etc etc or.... they could move the application to a supported platform with a wider developer
583.
by raesene9 5y ago
The thing is, in web appsec world, when Classic ASP was a production platform, we were very early in terms of what attacks would be prevalent and the defences that are generally added to modern web application frameworks were not in use. In
584.
by raesene9 5y ago
Sure old != bad if they maintain it... Classic ASP was good 20 years ago, it's harder to secure than a modern framework which helps with security (e.g. XSS helpers, ORMs to help mitigate SQLi, which is one of the issues exploited her
585.
by raesene9 5y ago
The thing about Classic ASP is that it has no in-built protections and the individual developer has to code all defence, which is not great. Also, how many classic ASP developers are there now , to add new protections for new issues... And
586.
by raesene9 5y ago
It does seem that more serious maintenance and auditing of these providers is needed. Looking at this thread on reddit https://old.reddit.com/r/msp/comments/ocggbv/crticial_ransom... which is by a compan
587.
by raesene9 5y ago
For the sake of debate, lets assume an equal level of incompetence between contractor run projects and government run projects. In that case at least a) There's no need to pay extra for the profit margins of the contractor companies (a
588.
by raesene9 5y ago
The largest stablecoin by Market cap, Tether, has been discussed on here, quite a few times.
589.
by raesene9 5y ago
I know that was the case in the past, but is it still the case? from a 10 minute look, the 4 largest exchanges by volume (Binance, Coinbase, Huobi, and Kraken) all seem to list USDC
590.
by raesene9 5y ago
USD Coin has indeed increased in use, although given the supposed liquidity of these two assets, you could wonder why the move doesn't happen far faster than it has... Also there's a very interesting difference between USDC and Te
591.
by raesene9 5y ago
Yep it definitely seems probable that there's risky behaviour at the least.
592.
by raesene9 5y ago
Indeed that's the question to... it's a huge variance depending on who it's to, the terms of the loans and the interest rates received. No Basel II capital adequacy requirements here :)
593.
by raesene9 5y ago
That's the key point of course, you don't know and neither do I. Nor does anyone else outside of Tether. Tether is the No.1 most traded coin (by a decent margin) which makes it a very large part of the ecosystem. Now if their asse
594.
by raesene9 5y ago
Indeed there were some interesting pieces in that. They would argue that the composition showed that they had the required reserves, others would argue it showed they were insolvent :) As tether specifies the right to repay any redeemed tok
595.
by raesene9 5y ago
A question is, how would you see evidence of this? Wash trading with Tether has been alleged before but, as far as I'm aware, it's not possible to definitively prove or disprove that it occurred. So to me, that's not a strong
596.
by raesene9 5y ago
The challenge with Tether is that it's basically impossible to prove or disprove their financial status. They don't have audited books, so no-one knows. So you need to decide whether they're a risk or not. To me, the idea of
597.
by raesene9 5y ago
Within the cloud native and container space, there is work being done on how to implement this (SBoM, Signing etc). It will obviously be tricky to get right, but there are groups looking at it :) https://github.com/cncf&#x2F
598.
by raesene9 5y ago
This may work if you could trust the venue that you place the short position with, however if Tether collaborates with the main venues, that won't work, if they can spike the price and wipe out your position. There are suggestions that
599.
by raesene9 5y ago
For me, for TOTP, I use one that backs up to iCloud. that obviously weakens the security, but increases the availability. With some applications, you can add additional devices, so you can add multiple, if you have 'em.
600.
by raesene9 5y ago
Sure, no security measure is perfect. Hardware tokens are likely to have better properties than TOTP, which has better properties than SMS, which has better properties than nothing. you can phish SMS exactly the same way you can phish TOTP,

More ›