Dan Murphy

🚨 Aqua Security has uncovered a significant risk in Git-based Source Code Management (SCM) systems like GitHub, GitLab, and Bitbucket. Deleted or updated secrets—like API tokens and credentials—can persist in these systems, creating "phantom secrets." 🚨 Why This Matters To You Even if developers overwrite or delete these secrets, they can remain accessible. This vulnerability has led to major exposures, notably in high-profile projects like Mozilla and Cisco Meraki. Here's the scoop: when developers commit hard-coded secrets in SCMs and then overwrite or delete them, these secrets can still persist in the repository versions. This makes them easy prey for malicious actors, especially in open-source projects or public repositories. The Scanner Shortfall Most secrets scanners today can't effectively scan these buried files. They typically use the git clone command to snapshot and scan repositories, missing some files deep in the file system. However, attackers who know what to look for can find them. The Takeaway Developers should never commit code with hard-coded secrets. Regularly rotate secrets and view secrets management as a full SDLC challenge. At Akeyless, we focus on making secrets management seamless and secure for developers from day one. Our solution not only secures your development lifecycle but also simplifies it and massively reduces costs by removing the burden of servers and maintenance. Protect your enterprise from the hidden risks of phantom secrets. Learn how Akeyless can help you secure your development lifecycle from start to finish like our Fortune 500 clients. Read this compelling research today. #DevOps #DevSecOps #GitHub #GitLab #Bitbucket

12

Interested to know how Coroot can improve your observability ? Here is the list of Coroot's most amazing features! https://lnkd.in/emDrcgX9 #coroot #opensource #observability

4

Some early next-day thoughts about #DASH2024 in New York City this year: 👌 Logs Workspaces look super promising ☀️ Flex Logs go GA (can't wait for Flex Traces 👀) 💥 On-call (👋 Opsgenie & PagerDuty) 🙈 GitHub is on Datadog (and OpenTelemetry!) 💸 Paypal is on Datadog too! 💜 OpenTelemetry + Datadog are getting closer than ever 🎉 Serverless improvements 🥂 Product Analytics revamp, becoming a proper competitor with products like Amplitude 🤖 Bits AI is being used in more and more products 👏 App Builder (custom UI components you can build yourself into the Datadog UI) is better than ever. 🤯 Live Debugger - merges the concepts of debugging and tracing 🔐 Datadog secures the entire software development cycle My biggest takeaway though is that Datadog is bigger than ever. But they are still developing products at an incredible pace and quality. From a Product perspective, they are hitting the nail on the head over and over again. Datadog releases things as early as possible as "Beta", "Private Beta" etc. This may frustrate users (as early products are immature), but it actually provides incredible opportunities for feedback. A bit of an observation: There are a lot more instances where Datadog goes past this "understanding platform" idea. It's now moving to be able to take action. This can be a slippery slope but I do think in many cases it makes loads of sense. A roundup from Datadog themselves of the keynote:

25

4 Comments

In Case You Missed It! Years ago I authored a paper on the security of mobile devices (having worked at AT&T, Cingular, and Sprint). Back then, we argued the mobile device was not a risk for the following reasons: slow connectivity (sub 2g), slow processors on the devices, closed operating systems, and no value to the data on the device. Today, those arguments are moot - fast speeds, fast processors, open OS, and all of your sensitive data is now there (banking, healthcare, etc.). Google has released patches for 50 security vulnerabilities impacting its Pixel devices and warned that one of them had already been exploited in targeted attacks as a zero-day. Patch your devices! https://lnkd.in/gT8mNbPZ

7

Grayton Ward built a cool way to generate IaC for different environments, offloading the bulk of configuration management (including segmenting) to feature flag providers. We speak to a lot of devs who use feature flags to control feature rollouts etc. But on the DevOps side, the user experience of managing GitOps-based deployments and infrastructure hasn't really advanced past editing config files. It's an interesting problem to solve. Grayton has built FlagOps—a template engine that lets OpenFeature-compatible services act as inputs to generate GitOps and IaC repositories. Write-up below (using Flagsmith as the example provider!) https://lnkd.in/eiJnG8Jz #gitops #devops #iac #featureflags

15

3 Comments

I discuss my thoughts on API Security best practices, authorization mechanisms, pitfalls and breaches in this article https://lnkd.in/gWwB4vwe

17

A trend we're seeing is folks starting out their SOC2 with AWS Inspector...then coming to realize it's shortcomings – lacking app & developer workflow context and little tuning/configurability. If you've ever seen a single vuln counted 30+ times...we can help you. Here's our pathway: https://lnkd.in/evJxtWmZ

13

1 Comment

JFrog & GitHub - Unveiling the Future Of EveryOps - SSO across both platforms - Bidirectional linking between source code and binaries - Unified view of security across both platforms - You can even ask GitHub Copilot Chat about your JFrog Processes

59

Indeed, OpenTofu and Valkey, being integral parts of The Linux Foundation, offer a robust open source framework that is well-positioned for long-term sustainability and resilience. OpenTofu, emerging as a community-driven alternative to Terraform Labs, promises an open and modular approach to infrastructure as code, backed by a strong commitment from over 140 organizations and 600 individuals. Similarly, Valkey, the open source successor to Redis, ensures continued collaborative development of its high-performance in-memory data store, maintaining the project under the open source BSD 3-clause license and supported by industry giants. #opensource #database #community #developers

11

TL;dr - RIP Terraform. Time to say goodbye. I just ran into this obituary for Terraform and Hashicorp. The most probable future seems to be the maximization of sales motion and the minimization of engineering investment - just adding another product to the price list and unleashing the sales force at it. The worst possible outcome would be if IBM decided to make Terraform part of their still-born cloud offering. Or maybe we’ll have Terraform for mainframe? #terraform #hashicorp #ibm #upgrade

32

5 Comments

🚀 Our work on Anvil won the Best Paper award at OSDI 2024! 💡 This paper shows how to build practical, formally verified cluster management controller implementations for Kubernetes. That's right, we *prove* that a Kubernetes controller implementation written in Rust is correct and meets its liveness and safety goals, subject to a formal specification. Anvil was the last project from the cluster management research agenda I founded at VMware Research, and is the culmination of 7 years worth of lessons we learnt trying to build robust cluster managers. I wanted to give a shout-out to the dream team behind this work. The author list represents folks from industrial research and academia, with experts in cluster management, distributed computing theory and practice, programming languages, formal verification theory and practice, testing and systems reliability! Practical systems verification is a lofty goal, and you need a highly inter-disciplinary team like this one to push the frontier. ⭐ The star of the show was Xudong Sun, the lead PhD student on the project, who had to work at the intersection of ALL those areas above! He is absolutely *fearless*, one of the key marker traits of a successful systems researcher. Xudong will be on the academic and industrial research job market this year -- if you're on a hiring committee, you'd be foolish not to hire him. :) You can check out the paper below (Xudong's talk will be out soon too). Authors: Xudong Sun, Wenjie Ma, Jiawei Tyler Gu, Zicheng Ma, Tej Chajed, Jon Howell, Andrea Lattuada, Oded Padon, Lalith Suresh, Adriana Szekeres, Tianyin Xu

162

13 Comments

If you’ve ever thought “there has to be an easier way to do DevOps”, check out this article on Kubernetes alternatives, featuring Cycle.io !

3

A recent incident involving the CEO of WPP highlights the growing threat of deepfake scams. In this case, scammers used a combination of voice cloning, fake images, and prerecorded footage to impersonate the CEO in a virtual meeting. Thankfully, the attempt was unsuccessful. This incident serves as a stark reminder of the evolving tactics cybercriminals are using. It's crucial for CEOs and other executives to be vigilant and aware of these sophisticated scams. #deepfakes #cybersecurityawareness #ceoscam #fraudprevention https://lnkd.in/g9HXK_6Z

10

🎤 Feature launch alert 🚀 🎉 You can now view all API calls across environments, apps and endpoints with user context in one space within the Levo.ai platform. You don't need to navigate multiple pages and applications to monitor API activity. Developers and security professionals waste precious time examining APIs scattered across all SDLC environments. More than a quarter of surveyed engineers reported spending 20+ hours working on APIs, much of which was dedicated to API debugging, inspection and monitoring activities. Similarly, cybersecurity professionals spend considerable time performing repetitive tasks needed to monitor APIs, detracting from their ability to drive business initiatives forward. That's why we've developed the Trace Explorer feature. It provides a single view into all API calls across environments, allowing developers and security professionals to focus on what truly matters. With Trace Explorer, API calls can be filtered based on: - API Methods - Application - API Paths - End-user context - Status codes, etc This makes it easier for security teams to identify, remediate, and prioritize API-related issues. Developers can also track active, dormant, and shadow APIs through status codes, ensuring that API sprawl doesn’t take root. #featurelaunch #cybersecurity #apisecurity #devsecops #startups

54

2 Comments

Kubernetes 1.30 "Uwubernetes" is out now! Check out the blog post to catch up on all the new features!

22

Apparently AWS Bedrock "on demand" is a shared resource pool, where noisy neighbours will cause rate limits for my few requests? Getting "Too many requests, please wait before trying again. You have sent too many requests. ..." for hours already :/ anyone else has experienced this as well? Using claude sonnet 3.5 and this makes me second guess going with Bedrock. Seems like provisioned throughput is only available for claude 2.0 - at $70.00 / hour. So, even it was available for sonnet 3.5, totally out of reach https://lnkd.in/eABtQ9jK

6

Due to recent events (RockYou2024 and Ticketmaster), there has been much talk about passwords and even more talk about MFA. MFA is not a silver bullet; it makes compromising accounts more challenging, but it also has flaws. Hopefully, we will see more things like passkeys & FIDO [https://lnkd.in/e32eiXJJ] soon. #passkeys #FIDO #mfa #rockyou

3

This is super cool. The declarative approach OSO takes with authZ is the key to making this work. I can also quite easily see the integration with Wasp down the road :).

2

AuthN is easy, AuthZ not so much. These 45(!) questions will get you started 😅. Don't want to spend time answering the questions? Try out our Permit.io for yourself and see how easy it is to add AuthZ to any application.

17

1 Comment