raesene9

15 ms·

211.
by raesene9 3y ago
you can also use docker rootless if you want that style of networking. Indeed AFAIK docker and podman rootless both use the same networking approach (slirp4netns)
212.
by raesene9 3y ago
you can get their 990 which has some details. Latest available is 2021 https://projects.propublica.org/nonprofits/organizations/460...
213.
by raesene9 3y ago
This definitely seems like an improvement over previous versions. It can now (at least in some cases) generate correct text for a given image. For example the prompt 'Neon sign saying "Scotland"' generated this https:&#
214.
by raesene9 3y ago
It's interesting that, in light of things like this, you still see large software companies adding support for new components written in non-memory safe languages (e.g. C) As an example Red Hat OpenShift added support for crun( https:&
215.
by raesene9 3y ago
What's not clear from the article is whether the ones lost were old ones or newer ones. If they're losing ones that were close to their max. life anyway that's possibly no great loss, however if they were newer satellites on
216.
by raesene9 3y ago
The article says average of 50
217.
by raesene9 3y ago
In the UK, I've seen a fair amount to TikTok shop fads pass on my For You Page already, mostly seem to be things like cleaning products or some clothing stuff. I could see the model being moderately effective as an advertising method,
218.
by raesene9 3y ago
In some cases, localhost is not just accessible from localhost :) https://unit42.paloaltonetworks.com/cve-2020-8558/ Also SSRF risks as mentioned elsewhere ...
219.
20 Years of Badgers(b3ta.com)
4 points by raesene9 3y ago|0 comments
220.
by raesene9 3y ago
When you say it's a hoax, what bit were you thinking of? Looking at Tesla's Website ( https://www.tesla.com/ownersmanual/model3/en_au/GUID-7A32EC0... ), it does say "Only the front doors are equi
221.
by raesene9 3y ago
People not upgrading is indeed a problem but not one the distributions or k8s can particularly address, unless they force upgrade people which with deprecation/removal of APIs doesn't tend to be popular :) The support lifecycle is
222.
by raesene9 3y ago
yeah if you give a user namespace edit access, then PSA is not going to help you (apart from that default config option you listed, but then even that is tricky as you need to know the namespaces to exempt like kube-system and others) Kubea
223.
by raesene9 3y ago
Worth noting that, on their own, namespaces are not security boundaries, they're (IMO) primarily intended to be organizational constructs. What namespaces do allow for, from a security perspective, is for various controls (e.g. RBAC, N
224.
by raesene9 3y ago
Out of curiosity, which bits of the k8s documentation (if there are specific bits) did you find lacking? If it's security related stuff, I can open some issues to see if things can get improved :)
225.
by raesene9 3y ago
For less complex options in modern k8s, you could configure Pod Security Admission on a namespace basis. It's not too complex as you just add some annotations to a namespace to activate it. The baseline policy will disable hostPath vol
226.
by raesene9 3y ago
Whilst Kubernetes defaults are indeed not great, they aren't that relevant unless you're building your clusters from scratch instead of using a k8s distribution, and I don't think I've seen anyone do that in a long time.
227.
by raesene9 3y ago
It did in the old days of the "Insecure API port" which listened on 8080/TCP, but that's been gone a while now. Whilst it usually was just bound to localhost, I did encounter a distribution that, by default, bound it to
228.
by raesene9 3y ago
I've done quite a lot of looking at exposed k8s clusters, and one thing this piece doesn't really cover is what percentage of the 350 clusters they identified were in fact honeypots. You can find k8s clusters without auth using Ce
229.
by raesene9 3y ago
So it is possible to expose Kubernetes without auth ( https://raesene.github.io/blog/2023/03/18/lets-talk-about-an... has some details) but it's not a default You can make that mis-configuration with
230.
by raesene9 3y ago
Most of the major cloud distros (AKS being the notable exception) do have --anonymous-auth enabled, although it's generally just /version and a couple of other endpoints exposed. Makes it easy to find out what clusters are running
231.
by raesene9 3y ago
for io_uring, I feel like it's a combination of bypassing seccomp and also the complexity of the code seems to be a fertile ground for Privesc vulnerabilities. I'd agree that unprivileged user namespaces should not be available
232.
by raesene9 3y ago
My own, quite limited, experiments with this kind of agree. On my personal blog I wrote a long series of posts on a specific topic (PCIs guidance for Kubernetes), and I was very interested to see if it reached the front page when up against
233.
by raesene9 3y ago
Possibly, but I'd say that Google's experience with kCTF was that allowing io_uring on hosts running containers has allowed for multiple breakouts. They paid out over $1m on io_uring related bug bounties https://securit
234.
by raesene9 3y ago
The advice on passwords very much depends on the level of control that a system operator has on its userbase, and the threat model of the site. In an end-user B2C style website, whilst passwords (and MFA) etc are needed for Authentication,
235.
by raesene9 3y ago
It didn't lose the whole case, it lost certain summary judgement issues, and prevailed on others, the real case there is still to come. It was overall a bit of a win for ripple but far from the end of the game.
236.
by raesene9 3y ago
Worth noting that this is hitting Alpha in Kubernetes 1.28, so won't be available by default at this stage. If you've got self-managed clusters, it'd be possible to enable with a feature gate on the API server, but it's
237.
by raesene9 3y ago
The article has a lot of interesting points, but seems to miss out on one of the main reasons (IMO) that startups take funding, which is to grow faster than (or as fast as) their competition. Unless you're lucky enough to be in a marke
238.
by raesene9 3y ago
https://raesene.github.io/ - these days, I generally blog about security/containers/k8s stuff that's interesting to me, and not suitable for a corporate blog, although it goes back to other stuff, as I'v
239.
by raesene9 3y ago
yeah the national law aspect is interesting, and I could see it really taking off as new restrictive laws get passed in specific countries. To take one example the UK Online Safety Bill could make access to a load of content trickier (or ev
240.
by raesene9 3y ago
Standard VPNs just shift the point of trust from the local network/ISP to the VPN provider, so the question becomes, can you trust the VPN company more or less than those local networks/ISPs? This depends on quite a range of facto

More ›