Türker Yıldırım

security

  • A workflow pinned by SHA rather than by tag

    Note1 min read

    A third-party action referenced by tag, and a tag being a movable pointer in somebody else’s repository. A tag can be repointed at any commit by anybody with…

  • The VPS that had been running since 2019

    Deep dive14 min read

    A host provisioned in 2019, upgraded in place three times, and a provisioning script that has never been run against an empty machine.

  • A webhook signature that had to survive a key rotation

    Note2 min read

    Rotating a signing secret without coordinating a deploy with four integrators, which is what sending several signatures is for. The overlap turns a rotation from an event requiring…

  • fail2ban rules that had been matching nothing since 2022

    Note2 min read

    Three jails enabled, two of them watching log files that moved when the services were containerised. A jail watching a file that does not exist reports zero failures,…

  • The four things a drill found, all of them access

    Note2 min read

    An onboarding drill for a third responder, which found nothing about knowledge and four things about permissions. Access is the failure mode that a knowledge-focused onboarding misses entirely,…

  • An on-call rota of three

    Deep dive10 min read

    A rota of two is not a rota. A third person joined in November, and the gap was everything learned in the shadowing month and never written down.

  • A fork’s first stable release, read carefully

    Note2 min read

    A fork six weeks old is a promise; a fork with a stable release and a governance model is a slightly larger promise. The difference between March and…

  • An editor capability that let too many people install fonts

    Note2 min read

    The font library screen is gated on edit_theme_options, which on this site was granted to a role created in 2019 for something else. A capability granted for one…

  • mysql_native_password is gone, and the user that used it

    Note2 min read

    An 8.4 container image, an application that could not connect, and a plugin that was disabled by default rather than removed. The plugin can still be loaded with…

  • A build secret that was in the image, in a layer, in the history

    Note2 min read

    A token passed as a build argument, removed in a later layer, and present in the image history for anybody who pulls it. A secret mount is available…