cyrnel

> to specifically want to allow escaping

Not really unfortunately. A novice sysadmin granting someone's request to add some permission called SYS_MODULE may not know that it could be equivalent to full root access. That's why posts like this are important for education.

If you have an agent installed on every node that can already traverse NAT, you don't have to care about what your ISP supports.

There are many more IPv6-centric solutions to their problem. Sounds like they didn't even try to think of alternatives and instead reached straight for NAT. That wasn't necessary, at least from the amount of information we can glean from this one post.

> We all know how well IPv6 adoption has gone

What frustrates me is that people keep building solutions like this that heavily rely on IPv4, even when forward-compatible options exist. With clever use of IPv6 transition technologies, you could have retained support for legacy devices while generally using IPv6 everywhere else.

I have hope for that problem to be solved too, with some combination of minimal kernels and live patching. I really don't think running two copies of everything and hammering CPU/RAM/Disk/Network with constant drain operations is a permanent solution for applying patches.

Good overview! I'd personally rather have better tooling for upgrades. Recently the API changes have been minimal, but the real problem is the mandatory node draining that causes downtime/disruption.

In theory, there's nothing stopping you from just updating the kubelet binary on every node. It will generally inherit the existing pods. Nomad even supports this[1]. But apparently there are no guarantees about this working between versions. And in fact some past upgrades have broken the way kubelet stores its own state, preventing this trick.

All I ask is for this informal trick to be formalized in the e2e tests. I'd write a KEP but I'm too busy draining nodes!

[1]: https://developer.hashicorp.com/nomad/docs/upgrade

> Making things worse, a lot of Docker images try to make configuration less painful by providing some sort of entry-point shell script that generates the full configuration from some simpler document provided to the container.

I see this as the container world reinventing the wheel of reasonable defaults for software that has long since lost sight of that. Nginx and Apache are two of the worst offenders, which won't just serve files out of a directory without a few dozens lines of config.

Not good fun when it's done in secret. That happened to me, and I was gaslit when I discovered the competing git repo.

Not saying that's what happened here, but too many people are defending this horrid concept of secretly making half your workers do a bunch of work only to see the boulder roll right back down the hill.

So many of the security monitoring tools that purport to detect things like that only work if the attacker is brainless. Modern networks are complex enough where a clever attacker (like a professional ransomware gang) can make malicious traffic look like any other traffic.

Unless this was just a public S3 bucket, there was probably some lateral movement involved, and I'd say time/money would be better spent reducing that particular risk in the future.

Good advice! I recommend this book, especially chapters 1 and 9: https://archive.org/details/technicalcommuni0000ande_y9j8/pa...

I'm also a sysadmin who unfortunately found that attitude familiar. Some IT groups really do create these toxic environments where it's common to make fun of the people they serve.

I certainly don't expect IT groups to bend over backward for every request or be polite in the face of real abuse, but the toxic shit that is said at the water cooler is never that. It's literally insulting people's intelligence or taking pleasure in people's pain, especially if it involves exercising their power over users.

> Why does it only check two? It thinks it figured out who I shot. And there’s the problem; I was pointing the gun at an LCD TV; a small widescreen monitor I keep next to my desktop alongside a CRT as a test setup.

> By the time the screen shows the white frames, the game already thinks you lost and went out to do something else.

Just so I understand correctly, did the game think the author shot the middle character? Just because it checked the middle character first and light was detected (due to the delay)?

Good summary! Not sure about that conclusion. I don't imagine there are roving bands of these specialized DNS network architects to whom you can magically outsource the operations.

The whole thing just strikes me as the continued under-valuing of this kind of maintenance work. It's not glamorous, you often work for a government/non-profit that pays less, on-call is brutal, and the chronic short-staffing is a pain multiplier. Not exactly the best foundation for an entire country's internet infrastructure to sit atop.

With the right amount of hardening, containers can provide a relatively secure sandbox. It's certainly not built for that which leads to natural weaknesses, but in my experience auditors seem pretty happy with the controls present in OpenShift (page 79): https://www.redhat.com/en/resources/openshift-security-guide...

> We really are canceling all meetings next week to facilitate this heads-down time, even 1:1s.

I can't image a worse time to cancel 1:1s than when pushing through some unpopular top-down decision.

The whole company's ability to fix current and future issues has been called into question as well: https://soatok.blog/2023/01/21/how-you-respond-to-security-r...

Why put a "fairly involved" solar system on top of a truck when you could just put it on the ground in a sunny spot? Maybe solar farms are too boring and effective to excite investors...

I wish load balancers would default to one of these optimal algorithms. When I call a "sort" function from the standard library, 99% of the time I don't have to go read papers to pick which sorting algorithm to use. The default algorithm is good for most cases. EDIT: probably because many of them are adaptive algorithms.

Seems many load balancer providers missed that memo.

It's only benign if we don't see new policies that say "everyone must disable keystroke obfuscation so we can still spy on traffic".

If a company's security strategy relies on the ability to tell if a given stream of encrypted bytes is shell traffic, and that it can be fooled by timing obfuscation, they need a better strategy. Attackers won't care to follow a "no timing obfuscation" policy.

I hope that kind of thing goes the way of other corporate efforts to break/backdoor encryption for the sake of "security". IMO, it's really the wrong way to go about security. Sure it would be nice to know if some automated script is being used to log into a machine, but better design can mean that information isn't important.

> “A best practice would be to firewall everything off,” Welch says. “But it’s like, well, no, you just broke all the scientific workflows.”

That's best-practice from the days of yore: where your security team is a group of non-technical, all-powerful dictators. Those don't still exist these days, right? Right?

> you’d have to cull them to prevent them overpopulating and destroying their environment.

We don't do this for cats, why should we have to do it for kangaroos? Trap Neuter Release exists. There have been struggles with implementing it, but it seems largely to do with lack of awareness and funding.

Routable IPs aren't the problem here. In fact under IPv6 you generally would give devices routable IPs. NAT is not a security mechanism.

Instead, you should put a default-deny rule on your firewall for all incoming traffic to user devices (which is generally the default setting anyway).

Is this the issue that the article is referring to?

https://www.macrumors.com/2023/07/10/apple-pulls-ios-16-5-1-...

> Unfortunately, it appears that the updates changed the Safari user agent to include an (a), leading some websites to break.

Lol...

In my case, I couldn't imagine configuring LittleSnitch to only allow certain hostnames from my browser. It has a "allow all traffic to 53/80/443" rule, otherwise most websites would flood me with hundreds of new LittleSnitch popups.

The graduation criteria I care about is "Have completed an independent and third party security audit". Lots of software in the cloud native world puts security in the back seat sadly!

> a term that starts with "ste" and is up to 5 letters long.

This is incorrect. The $5 matches up to 5 characters after "ste" for a total of 8 characters: https://ppubs.uspto.gov/pubwebapp/static/assets/files/Search...

I suspect it's taking a wild guess because this search tool came out after ChatGPT's 2021 data cutoff date.

I suspect the CVSS score has been over-estimated. For the "scope" metric, the "vulnerable component" and the "affected component" are both ServiceNow itself, so that should be "unchanged": https://security.stackexchange.com/a/129205

That drops you down to an 8.8. Also, log4shell was a 10.0, which got that extra .2 points from not requiring any privs, whereas this ServiceNow vuln requires "low" privs.

I use it in Kubernetes via https://github.com/openebs/zfs-localpv

The PersistentVolume API is a nice way to divvy up a shared resource across different teams, and using ZFS for that gives us the snapshotting, deduplication, and compression for free. For our workloads, it benchmarked faster than XFS so it was a no-brainer.

Sandboxing it yourself is fraught because any new feature could cause things like a syscall filter to crash the app. It has to be part of the application build/test/release process to prevent that, like it is in SWS.

Besides, we should be creating and using software that is secure by default: https://www.cisa.gov/sites/default/files/2023-06/principles_...

All linux processes have a default set of permissions that's absurdly large, even when not running as root. Web servers don't need but a fraction of those permissions. This may help: https://www.redhat.com/sysadmin/mastering-systemd