Ujjwal

[stypr @brokenpacifist]

mitmproxy: use `--emudhra` to sign TLS certificates 💀

[Ujjwal @r00tdaemon]

@mitchellh Well, these days you can setup an agent to monitor upstream to pull in minor/patch updates or backport security fixes which lowers the time cost for maintenance ig. Though I'm still unsure if the security outcomes are better with this approach than upgrading.

[Ujjwal @r00tdaemon]

Do you still stand by this, now that we have CVEs, kernel 0days dropping left, right and center these days?
@mitchellh

[Mitchell Hashimoto @mitchellh]

Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).

If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!

I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.

Feeling pretty swell about this mentality with all the supply chain attacks happening.

[Ujjwal @r00tdaemon]

@mitchellh Seems like a lot of overhead instead of upgrading with the added downside that existing tooling may not accurately alert you about future cve patches.
And trimming is only helping reduce supply chain risk but if a vulnerable code path is unreachable trimming doesn't help?

[Ujjwal @r00tdaemon]

@mitchellh What does it look like in practice?
So you fork, trim them down only to the functions you need.
How do you make sure it's maintained? What if there are bug fixes in later versions you can't simply cherry-pick?

[Ujjwal @r00tdaemon]

@poteto Is there a walkthrough style video of you using pstack?
Something like this by @mattpocockuk

https://t.co/M9cJKHUU45

[Ujjwal @r00tdaemon]

@awesomekling Are you reviewing the code?

[Ujjwal @r00tdaemon]

@RobertFreundLaw https://t.co/hDX3lbvubP
One of the first things I install on a mac

[Ujjwal @r00tdaemon]

@thedawgyg Thanks for responding. I totally agree with the learning by doing approach, that's what I prefer as well. But sometimes it gets difficult to figure out where to start with so much info everywhere? Do you face that? How do you overcome that?

[Ujjwal @r00tdaemon]

@mitchellh Been using @TermiusHQ lately. Working good so far

[Ujjwal @r00tdaemon]

@IanColdwater https://t.co/7jHRv8quYZ

[Ujjwal @r00tdaemon]

@stokfredrik Congratulations! 🔥

[mhackeroni @mhackeroni]

DEFCON finals explained

[Ujjwal @r00tdaemon]

@0xtakemyhand Nice find!

[Ujjwal @r00tdaemon]

@gregxsunday @infosec_au Amazing podcast! Very valuable for someone who's into source code analysis

[Ujjwal @r00tdaemon]

@NahamSec Congratulations! 🎉
100k soon 🔥

[Ujjwal @r00tdaemon]

@pdiscoveryio 1

[Ujjwal @r00tdaemon]

@martinmbauer Is there a @3blue1brown video which explains this?

[Ujjwal @r00tdaemon]

@IAmMandatory https://t.co/6qRJm5zUqK
Ha! I did a similar project few years back. It was pretty basic compared to yours but had the same name 😂