security – Page 16 – Türker Yıldırım

The DST Root CA X3 expiry and the clients that broke

NoteSeptember 28, 20211 min read

A root certificate expired on 30 September, and every server with a valid certificate started failing for clients with an old trust store. The server certificate was valid…

The certificate that expired on a root nobody controlled

Deep diveSeptember 7, 20219 min read

30 September, and a certificate chain that was valid on every browser we tested. The API works and three integrations do not.

Testing a chain against an old OpenSSL, in a container

NoteSeptember 2, 20212 min read

A chain that validates on your laptop tells you nothing about a partner running a 2016 trust store, and a container with an old OpenSSL is the only…

pull_request_target is a footgun with a nice name

NoteJune 29, 20212 min read

pull_request_target runs in the context of the base repository with access to secrets, and checking out the pull request code under it executes a stranger’s code with those…

A webhook endpoint that survives the sender

Deep diveJune 2, 202110 min read

The payment provider retried for six hours and every attempt timed out. A webhook is a notification, not a request for processing.

Terraform 1.0 is a promise about the next five years

Deep diveJune 2, 202110 min read

A version number that is a compatibility statement rather than a feature list. Three environments described by hand, and the import that is most of the work.

Compose v2 is a plugin, and the hyphen finally goes

Deep diveMay 19, 20219 min read

The same command, spelled two ways, on eight machines. A Python program became a Go plugin, and the container names changed underneath every script.

A self-hosted runner is a machine on your network

NoteApril 28, 20212 min read

A self-hosted runner solves the problem of reaching a private network by putting a machine that executes arbitrary workflow files inside it. The ephemeral mode is what makes…

The dotnet service that finally moved behind the same gateway

Deep diveApril 27, 202110 min read

One service in a different language, with its own auth, its own log format and its own deploy. The language was the least interesting difference.

A forced-trace header, behind a permission check

NoteApril 18, 20211 min read

Reproducing a problem with a header is far better than “try again while I watch the dashboard”, and it must not be a way for anybody to trace…