raesene9

78 ms·

871.
by raesene9 7y ago
It's part of the CNCF graduation criteria now, that any project which is going to "graduated" status has to have a 3rd party security review, so you should be able to get one for any of the projects in that category.
872.
by raesene9 7y ago
As with anything in security, this will depend on your threat model and the benefits of using k8s. There is some good information about securing k8s around, although we could always do with more. There's a free oReilly eBook on k8s sec
873.
by raesene9 7y ago
To me, this is another example of the "splinternet" phenomenon where the Internet is, in some ways, moving to become less of a universal resource and more regional in nature. It's a shame, as a lot of benefit has been derived
874.
by raesene9 7y ago
An article talking about investing in crypto that doesn't even mention the concerns around Tether, is one to be a little careful of... Even if you come to the conclusion that all is fine with a "stablecoin" that's not 1:
875.
by raesene9 7y ago
I think the modern version of that is Shodan image searches for Port:5900, which return a load of instances...
876.
by raesene9 7y ago
So Looking at Apple's store adding a 1TB SSD to an 21.5" iMac, is now a $600 upgrade and $500 upgrade on an 27" iMac On amazon a standard consumer can buy a 1TB NVMe Samsung 970 Pro for $329, and I'm guessing Apple aren&
877.
by raesene9 7y ago
I don't doubt the committment of RH to Open source, but looking at IBMs rather chequered history with regards to how they look to minimize costs, there must be some concern that next time there's a bad set of results, executive ma
878.
by raesene9 7y ago
Think you could be right there, so not a tiny amount of cash but looking at their page not even enough to have a full time dev on the gem tools... Obv. as a security person I'd say they should prioritise security things like audits and
879.
by raesene9 7y ago
based on their home page they're somewhere near the lower end of the $20k-$35k category for all funding...
880.
by raesene9 7y ago
so you feel that a group of volunteers with limited funding should do what precisely? as to losing adoption, that would only happen if a) there were other options with better security, and given that npm, PyPI and others have had similar pr
881.
by raesene9 7y ago
How do you suggest that Rubygems fund that effort? Also when you're staying away from Rubygems, which alternative will you be using, and do you think they have better security?
882.
by raesene9 7y ago
Do you feel that anyone in the community who isn't contributing financially or with their time to the project should expect to be able to "demand" anything from Ruby gems? The lack of funding for foundational parts of many po
883.
by raesene9 7y ago
Yep pretty much :) Actually it's worse than that. Even without 3rd party JS, most major websites these days run on large piles of open source libraries that have never been security reviewed (e.g. code from npm, rubygems, PyPi, NuGet)
884.
by raesene9 7y ago
My Anecdata is that I've got an HP Elitebook 840 G2 that I've had for ~5 years now. Works well, you can easily remove/upgrade RAM and storage and I've never had any problems with it. Recently acquired an HP Spectre x360
885.
by raesene9 7y ago
When I got started in IT in the mid-90's, it was working for an accountancy office. Lotus 1-2-3 was absolutely the main tool that was used. The move to Excel happened, due to the simple fact that with every Gateway PC we bought as we
886.
by raesene9 7y ago
yeah the question is though, can retail banking be profitable enough to satisfy VC like return levels... Retail banking whilst profitable (if done right) isn't wildly profitable, so the only way to rapidly ramp overall profits is to ex
887.
by raesene9 7y ago
True, the only real in-built option in k8s land for that is Service accounts, which aren't designed for user auth. but can be used for that purpose.
888.
by raesene9 7y ago
I've seen short-lived certs as a suggested workaround for the lack of revocation and as a user that might be the best option. That said the distributions I've seen that make use of client certs, don't do that (typical lifetim
889.
by raesene9 7y ago
There's (IMO) a mix. Kubernetes and cloud native software make a lot of use of TLS for mutual auth. A standard Kubeadm cluster (very vanilla k8s) has 3 distinct Certificate authorities, all with the CA root keys online. On top of tha
890.
by raesene9 7y ago
Softbank kind of reminds me of the Icelandic banks in the last bubble, in that in both cases I was wondering how they managed to get all the money they had. Just before it all went off that time, these icelandic banks were buying up everyth
891.
by raesene9 7y ago
From what I've read of it the mauritian government didn't really want to sell but the British implied strongly that it would be a pre-requisite for them gaining their independence... To quote a british official (from https:/
892.
by raesene9 7y ago
I'd say it avoids it, mitigates would work fine. The sum of the authentication credentials passed to the application is different for each site. with 2FA you submit password + token. so an attacker who is replaying compromised credent
893.
by raesene9 7y ago
It makes the point about relative volume, even if absolute levels are crap :) The volume point was around a stablecoin with issues having a higher relative volume than bitcoin itself.
894.
by raesene9 7y ago
Even a quick look at CoinMarketCap shows you that there's something a little odd about the current rally. Look at the volume column and you'll see that Tether has more volume than bitcoin and has had for a little while. Tether has
895.
by raesene9 7y ago
you know that Docker (by default) includes a seccomp filter as one of it's layers of isolation, right?
896.
by raesene9 7y ago
small aside, but it looks like rkt is not going to be that replacement. Recent disclosure of vulnerabilities in rkt that Redhat are apparently not going to bother patching indicates they don't currently see it as an active project.
897.
by raesene9 7y ago
RASP under "seed" did massively stand out as a "whhaaat?" moment
898.
by raesene9 7y ago
There's an active community of companies and individuals still working on what gets called LENR (cold fusion being a bit of a tainted term). However it seems to be an area that's rife with the potentials for scams, with some parti
899.
by raesene9 7y ago
So from a reading of the advisory and pull request, this seems to affect a specific set of scenarios, where a malicious image is running (attacker has gained access either to the running container, or compromised the image before distributi
900.
by raesene9 7y ago
I don't think there will be, we're well into "breach fatigue" territory now, and here there's not even currently any evidence of malicious use. Unless/until this breach results in a large financial hit to the c

More ›