varunsharma07

9 ms·

91.
Update on Security Improvement at the Eclipse Foundation(mikael.barbero.tech)
1 points by varunsharma07 4y ago|1 comments
92.
Implementing OSSF Scorecards Across a GitHub Organisation(blog.thestateofme.com)
1 points by varunsharma07 4y ago|0 comments
93.
Peribolos: Kubernetes Uses GitOps to Manage GitHub Communities at Scale(youtube.com)
1 points by varunsharma07 4y ago|1 comments
94.
by varunsharma07 4y ago
Stumbled upon this talk from 2019. Are there other similar projects for GitOps to manage GitHub org?
95.
Layoff information on Washington State employers(esd.wa.gov)
1 points by varunsharma07 4y ago|1 comments
96.
by varunsharma07 4y ago
It has numbers on the recent layoffs by Microsoft and Amazon. Information in the database is displayed by the date Employment Security receives the WARN notice.
97.
Open Source Security Foundation (OpenSSF) 2022 Annual Report [pdf](openssf.org)
2 points by varunsharma07 4y ago|1 comments
98.
by varunsharma07 4y ago
Good read about the different working groups and the progress made by OpenSSF in 2022.
99.
by varunsharma07 4y ago
While OIDC is a good option, at StepSecurity, we are building an open-source project that allows using your MFA tokens for deployments in CI/ CD. So far, it is implemented for GitHub Actions - https://github.com/step-se
100.
by varunsharma07 4y ago
If using GitHub Actions for CI/ CD, Harden Runner ( https://github.com/step-security/harden-runner ) can be used to audit and block DNS exfiltration. Outbound calls from CI are predictable (to source repo, artifact
101.
by varunsharma07 4y ago
If CI/ CD pipeline uses GitHub Actions, you can monitor and even block outbound network calls at the DNS and network level using Harden Runner ( https://github.com/step-security/harden-runner ). It can also detect o
102.
by varunsharma07 4y ago
OIDC that is a good alternative. This GitHub Action uses OIDC to authenticate the workflow to confirm secrets are only given to the authorized job. The differences between OIDC and MFA for publishing credentials are: 1) More control: each
103.
by varunsharma07 4y ago
w.r.t phishing: a maintainer intends to publish a release, will go to their GitHub Actions build log, and will click the link in the build log. So it is not a typical phishing scenario where one gets an email without context and clicks the
104.
by varunsharma07 4y ago
Yes. The workflow blocks and prints a URL every 10 seconds. The developer can click on the link and enter secrets in the browser. The workflow then continues, and secrets can be used in future steps.
105.
by varunsharma07 4y ago
To release the wait-for-secrets Action, I run the workflow using a PAT sent in via the browser. In that sense, it is similar to what you mentioned. I create the PAT during the release process and delete it after the release is done. I have
106.
by varunsharma07 4y ago
Thanks, Gaurav :)!
107.
by varunsharma07 4y ago
Added an issue to track this: https://github.com/step-security/wait-for-secrets/issues/56 The backend API is open-source, and the secrets are cleared immediately after use from the data store, but I agree thi
108.
Show HN: Publish from GitHub Actions using multi-factor authentication(github.com)
72 points by varunsharma07 4y ago|26 comments
109.
by varunsharma07 4y ago
The problem we are trying to solve is to automatically calculate what the minimum GITHUB_TOKEN permissions should be for a given workflow. We are solving this problem by building a knowledge base of permissions needed by each GitHub Action.
110.
Do you maintain a GitHub Action? Contribute to the SecureWorkflows project(blog.stepsecurity.io)
2 points by varunsharma07 4y ago|1 comments
111.
by varunsharma07 4y ago
If there was a way to know the behavior of NotPetya and realize that it has code to do things that M.E.Doc (the tax preparation program that was backdoored) was not supposed to do, that could have been used as a way to reject its installati
112.
by varunsharma07 4y ago
I agree. There are projects such as https://github.com/ossf/package-analysis and https://github.com/step-security/harden-runner that do behavior analysis. Disclosure: I’m maintainer of the second
113.
by varunsharma07 5y ago
Checkout this GitHub Actions workflow where the outbound calls made by some of these malicious packages are detected. Harden-Runner GitHub Action detects and blocks outbound calls for this exact reason - to identity malicious packages. htt
114.
by varunsharma07 5y ago
A new tutorial has been added to https://github.com/step-security/supply-chain-goat/blob/main... to perform behavior analysis of dependencies. For this a package was needed to simulate behavior of past hijack
115.
Show HN: Test Your Defenses with a Malware-Simulator Package(github.com)
2 points by varunsharma07 5y ago|1 comments
116.
by varunsharma07 5y ago
Here is one such tool for GitHub Actions: https://github.com/step-security/harden-runner . It would have detected and blocked the call to pastebin.com in this scenario. I am the maintainer of this tool.
117.
by varunsharma07 5y ago
Thanks for the feedback! w.r.t Bypass idea 1: If the compromised step is not supposed to call github.com, this will immediately get detected. This is the advantage of having outbound traffic correlated per step. Most steps do not need to ca
118.
by varunsharma07 5y ago
Most of the times compromised dependencies and build tools make outbound requests. This GitHub Action monitors the GitHub-hosted runner for outbound requests and allows setting a policy to block based on allowed endpoints. More details at:
119.
Show HN: harden-runner: GitHub Action to prevent software supply chain attacks(github.com)
11 points by varunsharma07 5y ago|3 comments
120.
by varunsharma07 5y ago
Thanks for the mention for harden-runner GitHub Action! sharing the link: https://github.com/step-security/harden-runner

More ›