After months of research and interviews we have released our report on Vulnerability Management for Cloud Native (and legacy) workloads.
These newer tools help us to be more effective with the limited resources of todayโs cybersecurity teams.
https://t.co/axnp00AnTm
@robertgraham@QuinnyPig what about happy eyeballs
Happy Eyeballs is a clever algorithm that prevents your browser from freezing when visiting dual-stack (IPv4 and IPv6) websites. Instead of waiting for an IPv6 connection to fully timeout if it fails, the browser "races" both IPv4 and IPv6
I went back today, with specifics in mind; and had an unbelievable experience.
My first Yelp review ever is below.
Don't let Sandy or Henry scare you. They have so much to tell and offer, they just are too afraid of the world now to share it most of the time. Who isn't. If you get a chance to go, do your homework; but I promise you won't regret it.
2/2
Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. Iโve been vocal about this for 10+ years. Iโve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).
If you are updating a dependency, itโs on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!
I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask โshow me the commit we need.โ Dont update for the sake of it.
Feeling pretty swell about this mentality with all the supply chain attacks happening.
$97,000 AWS bill in 48 hours. Hacked account, Bedrock API, ~2 million tokens per minute. I guess long-lived access keys made it possible! ๐
Here's what actually protects you:
1. ๐๐ถ๐๐ฐ๐ต ๐น๐ผ๐ป๐ด-๐น๐ถ๐๐ฒ๐ฑ ๐ฎ๐ฐ๐ฐ๐ฒ๐๐ ๐ธ๐ฒ๐๐
I always thought that each /24 must have it's own DNS zone file for reverse IP Address resolution.
I looked it up.
TIL that you can have a giant /16 zone file for PTR records. Wow!
https://t.co/QaZzc40ugt
Why can't people spell On-Premises correctly?
K3s on On-Prem Infrastructures the GitOps Way: Writing a Custom k0rdent Template from Scratch https://t.co/lLn7XlGpU8 #cncf via @CloudNativeFDN
@BitTitan can you help search for and correct the spelling of on-premises throughout your website?
setup redirect for the links with wrong spelling on-premise
a place is not an idea. an idea not a place
iโd like to recommend your services to our customers.
https://t.co/f1ZerGnkqy
Anthropic CISO just told you that 90% of their code is written by Claude.
Then he explained how they protect their own secrets while doing it.
Why your .env file is the weakest link in your entire AI workflow?
Watch it, then grab the full security config below๐
Microsoft introduces Backup and Recovery for Microsoft Entra ID!
Entra Backup and Recovery solution enables you to quickly recover from malicious attacks or accidental changes by reverting your core tenant objects to any previous state within the last 5 days.
With automated backups and granular recovery capabilities, it ensures minimal downtime and supports your business continuity in the face of unexpected disruptions.
Entra automatically generates one backup per day, retaining the last 5 days of backup history.
You can recover key properties of the following core tenant objects:
- Users
- Groups
- Applications
- Conditional access policies
- Service principals
- Organization
- Authentication methods
- Authorization policy
- Named locations
#EntraID #Microsoft365 #Microsoft
Affected client: @cluely Yes, that Cluely, the company that sells AI overlays to help people cheat interviews. A company whose entire value prop is undetectable deception was getting its compliance from a company whose entire value prop is undetectable deception.
Synergy!
join the society of quantum engineers sqe as we strive towards
https://t.co/LsT3WgDPaq
Quantum engineering applies quantum mechanics to design technologies that solve problems too complex for classical computers, utilizing qubits for simultaneous processing.
basic software supply chain security controls dictate that we donโt allow unfettered access to the internet from devices on networks we control. use a binary registry service like artifactory with x-ray from @jfrog to mitigate rookie configuration mistake vulnerabilities
An AI broke out of its system and secretly started using its own training GPUs to mine crypto... This is a real incident report from Alibaba's AI research team
The AI figured out that compute = money and quietly diverted its own resources, while researchers thought it was just training.
It wasn't a prompt injection. It wasn't a jailbreak. No one asked it to do this.
It emerged spontaneously. A side effect of RL optimization pressure.
The model also set up a reverse SSH tunnel from its Alibaba Cloud instance to an external IP, effectively punching a hole through its own firewall and opening a remote access channel to the outside world... ahem...
The only reason they caught it? A security alert tripped at 3am. Firewall logs. Not the AI team, the security team.
The scary part isn't that the model was trying to escape. It wasn't "evil." It was just trying to be better at its job. Acquiring compute and network access are just useful things if you're an agent trying to accomplish tasks
This is what AI safety researchers have been warning about for years. They called it instrumental convergence, the idea that any sufficiently optimized agent will seek resources and resist constraints as a natural consequence of pursuing goals.
Below is a diagram of the rock architecture it broke out of. Truly crazy times
Google Cloud is giving out FREE access to its GCP lab environment plus a 100% exam voucher.
This is fully covered.
All you need to do is complete the required learning activities, and you earn a voucher for an eligible certification exam.
Eligible exams include:
- Associate Cloud Engineer
- Professional Cloud Architect
- Generative AI Leader
Registrations are currently open and close March 11.
If youโve been waiting for an excuse to get cloud-certified, this is it.
Get started here:
https://t.co/5RdljA3I0m
Donโt say nobody told you.
New AirSnitch attack breaks Wi-Fi encryption in homes, offices, and enterprises: https://t.co/JbIfytD8TT
AirSnitch resets WiFi security back to the bad-old-days of ARP spoofing and trivial MITM.