Türker Yıldırım

security

  • json_validate on a webhook body before anything else

    Note2 min read

    A webhook endpoint accepting bodies up to eight megabytes, and the signature check running after the decode. Validating before decoding costs one pass over the string and allocates…

  • The certificate that renewed itself and nobody verified

    Note2 min read

    A renewal job that had been running successfully for two years, and a certificate that had been served from a stale copy for the last three months. Monitoring…

  • Four credentials that existed on one laptop

    Note2 min read

    An inventory of what a second person would need, produced by asking one person to stop using their own machine for a day. The DNS account is the…

  • The dependency we vendored

    Deep dive9 min read

    A 200-line package with 41 transitive dependencies, doing one thing, and an advisory in something four levels down that we had never heard of.

  • Reproducing a build from six months ago

    Deep dive14 min read

    A security question about a release from July, and no way to rebuild it. The same commit produces a different image, and neither of them is wrong.

  • An idempotency key on a POST, documented

    Note2 min read

    A client that retried a timed-out payment request and created two, and no way for them to have avoided it. The conflict case is the part that has…

  • PHP 8.0 reaches end of life, and what that changes

    Note2 min read

    26 November, and what changes is not the code — it is that no security patch is coming for whatever is found in December. The argument that gets…

  • An environment with a required reviewer on production

    Note2 min read

    A deploy job that anybody with write access could trigger, on a repository where write access was granted to six people for unrelated reasons. Scoping the secrets to…

  • The alert that fired for two years and meant nothing

    Deep dive10 min read

    Thirty-one alert rules, a channel muted by everybody, and 412 alerts in a month of which four corresponded to a real problem.

  • Composer 2.6, and audit as a pipeline step

    Note2 min read

    The audit command has been there since 2.4 and had never been run by anything except a person remembering to run it. Two of the four were noise…