security – Page 13 – Türker Yıldırım

Applying a saved plan, so the review means something

NoteMay 31, 20221 min read

Re-planning at apply time means the thing that runs is not the thing that was reviewed, which defeats the review entirely. A saved plan is tied to a…

An SLO that survived contact with the business

Deep diveMay 17, 202214 min read

99.9% was written in a document in 2020 and had never been measured. Three teams with three definitions of “up”.

A container that writes files the host cannot delete

NoteMay 10, 20222 min read

A bind mount passes numeric uids straight through, so a container running as uid 1000 writes files owned by whatever uid 1000 is on the host. The macOS…

hash_equals for anything that arrived in a request

NoteApril 28, 20222 min read

String comparison short-circuits on the first differing byte, which leaks how much of a secret an attacker has guessed. The argument order is the detail that is almost…

A scanner reports what has package metadata, and no more

NoteApril 14, 20221 min read

An image scanner identifies packages from manifests, so anything installed by a shell pipe or copied in as a binary is invisible to it. A green scan means…

ACL v2 selectors, for a key pattern per command

NoteApril 12, 20222 min read

ACL v1 gave one key pattern for all permitted commands; selectors let a user read one prefix and write another. ACL DRYRUN is the command that makes this…

ip a, ss -tlnp, and the ports nobody documented

NoteApril 6, 20222 min read

A host that has been running for four years is listening on things nobody remembers configuring, and the audit is two commands. Binding to 0.0.0.0 and relying on…

The N+1 that was in the authorisation layer

Deep diveApril 4, 202210 min read

A policy check that loads the model’s owner, per row. 200 queries on a page with 50 items and correct eager loading.

Moved blocks, and the Terraform refactor that destroyed nothing

Deep diveMarch 30, 202210 min read

1.1, and a block that renames a resource without destroying it. Renaming a module meant a plan that wanted to drop a database.

A tmpfiles.d entry beats a chown in a deploy script

NoteMarch 11, 20221 min read

A deploy script that fixes ownership runs once per deploy and does nothing about a directory created afterwards by something else. The age field turning it into a…