616 karma · joined September 3, 2010
Projects:
Is your site IPv6 ready? -- https://ready.chair6.net
Personal blog -- https://chair6.net
Social:
https://twitter.com/finnigja
https://www.strava.com/athletes/finnigja
JSON.stringify([...document.querySelectorAll('.fatitem table .athing')].map(el => [el.textContent.trim(), el.nextSibling.textContent.trim()]).sort(([,a], [,b]) => parseInt(b) - parseInt(a)))
Abridge collects data across your configured set of AWS accounts & regions. It doesn't draw architecture diagrams, but instead will give you x-vs-y visualizations for a number of different relationships .. IAM users vs. groups, Lambda functions vs. runtimes, EC2 instances vs. keypair, etc.
It'll also provide inventory tables / CSV dumps of the different resource types, and simple free search across all resources.
Security-wise, Abridge collects data via cross-account trusts with the SecurityAudit role, and expires all collected data after 48 hours - more at https://abridge.io/security/.
https://github.blog/changelog/2020-05-06-github-advanced-sec...
Have spent some time with the beta, definitely worth a look.
The game is pretty fun too!
It's proactive, but I've been working in various security-oriented IT roles for ~15 years now, and I'm trying to take my own advice [1], so I'd hope I can do it justice. :)
[1] https://chair6.net/startups-and-security-questionnaires.html
Security is of course a concern - I address that in more detail at https://abridge.io/security/ but the two main parts - 1) collect data from AWS accounts via read-only cross-role access (AWS-managed SecurityAudit policy) and 2) throw all that data away every 48 hours (S3 object expiration).
It still has rough edges, but I'd greatly appreciate a) any feedback on site/content and b) signups from folks who might be interested in testing it out...
We are looking for Product Security Engineers to help scale our product security function, which works closely with engineering & product management to ensure that security is appropriately addressed across the HashiCorp product suite.
In this role, your responsibilities will include:
* Plan & execute security assessments (dynamic testing, static testing, code review, etc) and threat modeling of HashiCorp’s products, services, and associated cloud infrastructure.
* Build and implement security solutions across the product life-cycle, such as standalone security tools, CI/CD pipeline integrations, product security features/fixes, etc.
* Monitor threats and vulnerabilities impacting HashiCorp products and services, develop proof-of-concepts as appropriate, identify mitigations and assess/communicate associated risk.
We are looking for talented self-starters with 4+ years of security experience. We will consider experienced engineers with less security-specific experience but the desire to learn!
More information and application at https://www.hashicorp.com/jobs/1664419.
From my own experience, and watching a number of other friends, the first 2-3 days of skiing is easier than the first 2-3 days of snowboarding.
These days I'll happily ski/board most places on most mountains (in-resort, at least) but if I'm getting into technical terrain will vastly prefer a snowboard.. much quicker recovery time if you fall, often you can just bounce back up w/out fully stopping. I'd argue that snowboards are more fun in the pow as well.. skis are great for the hard-and-fast groomer days!
If you're a nerd, and you like skiing / boarding, then check out ski touring / splitboarding. Add backcountry travel, navigation, skin track setting, & most importantly avalanche / snow safety, and you've got a sport that is almost endless in terms of things to learn & keep in mind while you're out and about. And it's excellent exercise while you're at it!
Plenty of passengers ride the bus, but the bus is not redefined by this.
Smell, sickness, graffiti, background noise, and even the occasional pleasant conversation.. all things passengers bring to the bus that may not actually redefine it but do potentially have lasting impact on the bus itself and shape the experience for all parties involved.
Microbiome is one of the things we're including in the Arivale program. Early days on the research front, but fascinating stuff - our clinical team have written up two less philosophical, more scientific articles re. correlations of microbiome to health at https://www.arivale.com/gut-microbiome-tmao-heart-heath/ and https://www.arivale.com/gut-microbiome-crohns/.
Anecdotal, but what worked for me was stopping walking around with my hands in my pockets. Seriously! Must've been something to do with body tension - once I figured out that letting my arms swing freely when I walked places, instead of keeping them rigidly in my pockets, the pain went away and hasn't come back.
A few rabbit-holes to dive down:
https://www.us-cert.gov/ncas/alerts/TA14-017A
http://www.christian-rossow.de/articles/Amplification_DDoS.p...
https://tools.ietf.org/id/draft-byrne-opsec-udp-advisory-00....
The OpenStack community uses Gerrit pretty widely across our various projects. It might help to check out a busy project like Nova (https://review.openstack.org/#/q/project:openstack/nova,n,z) to get a feel for how Gerrit works in practice. Or a less-busy project like Bandit, which I'm involved in (https://review.openstack.org/#/q/project:openstack/bandit,n,...).
I can't exactly say I'm proud of this, but I was somewhat surprised by how relatively easy it was to pull a basic GUI together...
Cool to see tools lasting / improving, but depressing that SQLi is still so pervasive...
They have an interactive shell for it - experiment with http://interactive.blockdiag.com/nwdiag/.