Türker Yıldırım

security

  • The integration that outlived the integrator

    Deep dive10 min read

    A supplier acquired and shut down, and an endpoint returning 200 with an empty body for eleven weeks.

  • A retention report that asserts rather than describes

    Note2 min read

    A monthly report on retention that nobody read, converted into three assertions that fail. A report describes and an assertion fails, and the difference is whether anybody has…

  • An image rebuilt weekly, and the week it was not

    Note2 min read

    A scheduled base image rebuild, disabled during an incident in November, restored in February. A guard and the thing it guards being disabled together is the ordinary shape…

  • An ssh certificate authority, and the key’s own backup

    Note2 min read

    A certificate authority that removes eleven authorized_keys files and creates one key that must not be lost. Concentrating eleven files into one key is the point of a…

  • Composer’s audit as the only gate that has ever failed

    Note2 min read

    Four merge gates on the pipeline, and after a year one of them has ever blocked anything. A gate that fails on your own change is feedback and…

  • PHP 8.1 reaches end of life, and the one host still on it

    Note2 min read

    December, the end of security support for 8.1, and a host running it that nothing in the deployment inventory knew about. The end-of-life date is not the story…

  • A second backup provider with write-only credentials

    Note2 min read

    Every backup in one provider, and a plan that assumed the disaster would be local rather than at the provider. Ranking the failure modes is what makes this…

  • Reviewing code I did not write

    Deep dive10 min read

    Review as the skill that matters, and a volume of code that needs it. A change that looks right, passes, and is subtly wrong.

  • A plugin with no admin screen

    Deep dive10 min read

    A plugin whose entire configuration is a constant and a filter, on a site whose deployment is a pipeline.

  • Object lock, and a deletion that could not happen

    Note1 min read

    A second backup copy that survives a compromised credential, which requires the storage to refuse deletion rather than the credential to lack permission. A write-only credential protects against…