security – Page 10 – Türker Yıldırım

A backup we restored on purpose, every month, forever

Deep diveApril 5, 20238 min read

A backup that had run nightly for four years and had never been restored. The first restore produced a database missing one table.

A base image we build ourselves, and the CVE report that paid for it

Deep diveMarch 15, 202310 min read

A scanner reporting 41 vulnerabilities, 39 of them in packages we do not use. A weekly report that has never once been actionable.

Pinning a base image by digest, and the day it mattered

NoteFebruary 23, 20232 min read

A tag is a moving pointer, so php:8.2-fpm in a Dockerfile is a build that is reproducible until the day it is not. Pinning by digest turns an…

A workflow job that needed read-only permissions

NoteFebruary 21, 20232 min read

The default token permissions in an older repository are write-all, which means every third-party action in every job can push to the default branch. The blast radius argument…

fail2ban after moving ssh off 22, and why both

NoteJanuary 27, 20231 min read

Moving the port dropped the log noise by about 99%, which is the argument for doing it and not an argument for stopping there. A non-standard port is…

The Dockerfile that finally stopped installing the world

Deep diveJanuary 25, 20238 min read

A 1.4 GB image and a six-minute build, for an application that is 40 MB of PHP. Most of it is build tooling that shipped by accident.

The container that ran as root because of one chown

NoteJanuary 2, 20232 min read

A Dockerfile that switched to a non-root user, then switched back for one directory permission and never switched forward again. The line that switched to root was correct…

#[SensitiveParameter] keeps a password out of a stack trace

NoteDecember 21, 20222 min read

A stack trace includes argument values, so an exception thrown anywhere below a login method has historically printed the password into a log. This closes a leak that…

The webhook we sent, and the retries we owed

Deep diveDecember 7, 202210 min read

Being the sender, for the first time, and the obligations that come with it. A customer endpoint that was down for six hours.

A data inventory is a file, and it maps personal data

NoteNovember 17, 20222 min read

A deletion request arrives and the first question is where the data is, which is not a question anybody can answer from memory. The reason field is what…