The licence changed in January from Apache 2.0 to a dual SSPL and Elastic License arrangement, which is a legal event with an infrastructure consequence. For an internal…
A predictable temporary path in /tmp is a symlink attack and a collision between two concurrent runs, and both are avoided by three lines in a specific order.…
Authenticating a script against the REST API meant cookies and a nonce, which needs a browser, or a real password in a configuration file. Saying plainly that it…
The stock sync used the marketing manager’s account. 5.6 shipped application passwords, which is the mechanism that had been missing since the REST API.
Serving the interactive documentation from the application is convenient and publishes a complete map of every endpoint, parameter and error code to anybody who finds the URL. The…
The database password was in the repository, then in the image, then in an environment variable readable by anything that could run ps. Where it went next.
The audit asked where the database password is and there were five answers, all of them true. Enumerating the copies is the first hour and is usually the…