raesene9

73 ms·

841.
by raesene9 7y ago
I'd have developers working in Dev VMs on their laptops, and sure I'd let them have root access to those.
842.
by raesene9 7y ago
What's interesting, to me, about Docker as a company perhaps not doing well is how that'll impact Microsoft. Microsoft have done a load of work on getting containers running well on Windows servers and that work relies on Docker
843.
by raesene9 7y ago
Whilst k8s can run on any CRI compliant runtime, I've never actually seen a prod. deployment use anything other than Docker.
844.
by raesene9 7y ago
Why would you be allowing devs to directly deploy to production in a company with 30,000 developers? Surely you'd have proper release management where Ops teams would review deployment artifacts before deploying them?
845.
by raesene9 7y ago
A couple of things :- You can still mount filesystems as root from a container, if you have Docker command rights. In Docker's security model access to run docker commands on a given host == root, that's a design choice AFAIK,
846.
by raesene9 7y ago
What makes you think OSS is sustainable? There have been various problems with key projects due to lack of funding (e.g. OpenSSL, GPG) There area huge number of libraries are are becoming unmaintained due to lack of resources, which will l
847.
by raesene9 7y ago
Out of curiousity, does the organization you work for contribute money to the Open source libraries it uses via existing mechanisms (e.g. gratipay, Github sponsors)?
848.
by raesene9 7y ago
I'm glad to see the browser developers being proactive to help protect users from this kind of thing. I'll be very interested to see what happens when it's countries they have more connections to, who start doing this kind of
849.
by raesene9 7y ago
For all the people who are rightly concerned about these attacks here's a a couple of questions - Would you pay money for access to a package repository that had good security practices? How much would you pay? Would you accept delays
850.
by raesene9 7y ago
That's a view of course (although in the case of gVisor they don't actually do versioned build just nightlies) but here's a question. As a consumer of software libraries, have you ever looked into the security practices of th
851.
by raesene9 7y ago
With regards to Rubygems, the challenge is likely to be where they get the resources for additional security measures. All the major language repo's are free at point of use, and I don't get the impression the maintainers are exac
852.
by raesene9 7y ago
I'd debate the relatively effective piece in light of webmin being backdoored for a year, and of course remember we're only hearing about the ones that have been found, not the ones that haven't. There's a number of poss
853.
by raesene9 7y ago
I'd expect that very much depends on the software in question. As one example that I'm aware of, gvisor from Google delivers nightly builds. So they're building and pushing every single day. It'd depend on the individua
854.
by raesene9 7y ago
Yeah this problem has been a known issue for a long time, but there really is no easy fix, and incentives are stacked against it getting resolved in any meaningful way. I did a talk for AppsecEU back in 2015 on this topic and found good mat
855.
by raesene9 7y ago
Whilst I'm not an intelligence analyst, this seems like a pretty basic/untargeted attack for a nation state. It could be one, but it could just as easily be one of the many criminal gangs who used credential spraying to get access
856.
by raesene9 7y ago
It would help for sure, I'd guess the problem would be , will the maintainers of all these libraries be happy with the overhead that this would introduce. A less invasive control might be to notify all owners when a new version is push
857.
by raesene9 7y ago
Say your CI pipeline runs automated tests, builds the gem and pushes to Rubygems, it needs permissions to push to Rubygems. So if an attacker compromises the API key used by that pipeline, they get the rights to push to Rubygems.
858.
by raesene9 7y ago
Following closely on from Webmin's compromised CI/CD pipeline, this is another instance of the growing problem of supply chain attacks. With the software supply chain being as complex as it is, and the large number of moving parts
859.
by raesene9 7y ago
Unless the attacker had very poor OpSec, it would be hard to track them down, even assuming the relevant police force had the skills/manpower to do so. Then you get the delight of likely jurisdictional issues, if it turns out the attac
860.
by raesene9 7y ago
It's not just rubygems that has this issue, it's all the other repos too, most of which (AFAIK) don't enforce 2FA Also worth noting that whilst MFA helps, it's not a panacea as MFA isn't generally compatible with au
861.
by raesene9 7y ago
UK Person here. It's not as common as it used to be but still a thing. There's coal delivery people they deliver sacks of coal to your house. Mainly rural areas, although these days boilers will more likely to be oil fired or LPG
862.
by raesene9 7y ago
I think there's a bit of mystique about how dangerous the Defcon network is, and it doesn't really reflect the current reality. To quote the defcon27 FAQ https://www.defcon.org/html/defcon-27/dc-27-faq.ht
863.
by raesene9 7y ago
Interesting. This seems like a big bet for IBM given that they used over 70% of their cash pile to buy Redhat. That said the picture painted by this article is that doing nothing wasn't an option, declining revenues is not a good pict
864.
by raesene9 7y ago
Out of curiousity, Which k8s attack vectors, do you think are particularly concerning?
865.
by raesene9 7y ago
I don't think Monzo had to adopt k8s to survive. It's an infrastructure technology not something which provides a unique advantage from an app. development perspective. Also k8s is far from only used in tech companies. the UK hom
866.
by raesene9 7y ago
Sure rapid development is likely to equal lots of change, but it's far from alone in that regard. The last decade has been dominated by rapid adoption of technologies that were under heavy development at the time, from Ruby on Rails, t
867.
by raesene9 7y ago
There is a GH issue tracking the findings from the report https://github.com/kubernetes/kubernetes/issues/81146
868.
by raesene9 7y ago
For me, the largest one mentioned is a known security issue with k8s architecture, which is the lack of support for certificate revocation. So anywhere client cert's are used for authN, if one is lost there's no way to revoke it,
869.
by raesene9 7y ago
yeah that one is kind of interesting, really needs more detail. I think what they're talking about is that it's possible to configure insecure connections between the different components. However, if that's the case, t
870.
by raesene9 7y ago
If security got to be the number one concern for whether things were deployed or not, then sure we could likely take a more conservative view. However realistically k8s is in heavy deployment in a wide variety of industries including public

More ›