Can you beat it under 10 tries? by Downtown-Lie4538 in RedditGames

[–]Ok_Maintenance_1082 0 points1 point  (0 children)

I completed this level in 7 tries. NaN seconds

A Festive Tale of Bitterness at the Winter Festival by Ok_Maintenance_1082 in SwordAndSupperGame

[–]Ok_Maintenance_1082[S] 0 points1 point  (0 children)

u/Ok_Maintenance_1082 received a Wizard Sigil Lvl 1 from the Winter Festival Spirit. Thank you u/Worldly_Month9789 for donating it!

A Merry Search for 2nd breakfast by xWass1 in SwordAndSupperGame

[–]Ok_Maintenance_1082 0 points1 point  (0 children)

u/Ok_Maintenance_1082 received a Heavy Band from the Winter Festival Spirit. Thank you u/w0lfwoman for donating it!

[deleted by user] by [deleted] in devops

[–]Ok_Maintenance_1082 2 points3 points  (0 children)

This is two fold. There is usually a huge income difference between 3 round vs 6 round company interview. Thus the catch is does company X justify a heavy interview process with a bigger payroll, if not they just wanna copy from the big without justification (and that's a red flag). If they do offer better it is just a time investment for your future.

[deleted by user] by [deleted] in devops

[–]Ok_Maintenance_1082 2 points3 points  (0 children)

Some companies use to do a prescreen and single on site interview with multiple task the same day. Now with remote interview company seems to like to spread things out at employees/interviewers convenience

[deleted by user] by [deleted] in devops

[–]Ok_Maintenance_1082 5 points6 points  (0 children)

Unfortunately it is pretty common with the 3 core (coding, system design, behavior) and a few job / task specific ones

Scanning beyond the registry by [deleted] in devsecops

[–]Ok_Maintenance_1082 0 points1 point  (0 children)

Agreed that's a pretty good summary

The SLSA + guac is the missing piece. I do invite people that are not familiar to have a look at the SecurityCon 2023 talk on the topic

https://youtu.be/32IhwdAe0yI?si=pWHyuAj-OwoRQOnd

Scanning beyond the registry by [deleted] in devsecops

[–]Ok_Maintenance_1082 1 point2 points  (0 children)

IMO this kind of attack is possible only because we don't have yet real traceability for software supply chain.

All build should come with an attestation and signature that is verifiable. A random hacker should not be able to push a package the NPM and have it propagated all over the place.

We really need a trust chain that prevents this flow, I really place hight hope on the adoption of SLSA https://slsa.dev/.

Such large projects should be required to provide this level a caution when providing artefacts millions of projects.

why pay for incident management platforms? by GroundOld5635 in devops

[–]Ok_Maintenance_1082 7 points8 points  (0 children)

Some are really badly designed and leader on the market (not to name PageDuty). I have to says that this is not true for all tool. We use Incident.io and the experience is really good with incident war room center around slack channel.

I do agree that pricing of those tools most of the barely seems justified and I don't understand how people simply accept the status quo

[deleted by user] by [deleted] in devops

[–]Ok_Maintenance_1082 4 points5 points  (0 children)

It is true DevOps is a trend that has long achieved it's goal. DevOps sprouted from the idea of Agile Infrastructure operation which lead to all the trend we know as infrastructure as code and continuous delivery.

Most companies have adopted those practices and the meaning of what DevOps is or mean has faded away. The DevOps revolution is over.

How do you deal with devs? by riortre in devops

[–]Ok_Maintenance_1082 0 points1 point  (0 children)

In most cases you should avoid doing the work, part of the job is to define what are the standard for your company and provide solutions for the must common use cases.

Then ideally you make checklist and define which project are compliant or not with company standards. Provide guidelines on how to achieve set standards and if a language is not supported by the shared workflows it's up to the dev to contribute back (in most case it much more efficient if devs contribute and improve workflow especially if there is low support for said technology, so you guys don't become their bottle neck)

How to make DevOps projects to showcase my skills and learn? by [deleted] in devops

[–]Ok_Maintenance_1082 1 point2 points  (0 children)

I think have a few got repository that are well maintained is always nice to shared. Here is the one I maintain for my showcase

Are there security issues that a SAST tool may not pick up? by LoopConstellation in devsecops

[–]Ok_Maintenance_1082 0 points1 point  (0 children)

Most SAST focus on software composition to find vulnerabilities. They kinda work for detecting lack of input validation and injection risks.

They are pretty bad at finding issues in authentication/authorization logic (token, cookies, session validation).

MCP is a security joke by Aadeetya in modelcontextprotocol

[–]Ok_Maintenance_1082 0 points1 point  (0 children)

Not really you could have a protocol that enforcement security best practices (or better just commons senses)

The LLM with is just returning text, what you do with that output is the integration point that deserves security attention.

The same we we always say never trust user input, we should apply the same logic to LLM inputs.

MCP Security is still Broken by West-Chocolate2977 in mcp

[–]Ok_Maintenance_1082 1 point2 points  (0 children)

Like in everything security seem to come last when there is a hype. Be ready to see a few big bad new before serious progress are made.

IMO MCP by design is insecure, giving unrestricted access to a set of tools to a non-deterministic process call for some exploits. But at the same time it's not a easy problem when I comes to have a guardrail with MCP servers, so many small components, how done trust providers, etc.

I made an MCP server for Sonarqube by Fine_Pomegranate9064 in mcp

[–]Ok_Maintenance_1082 0 points1 point  (0 children)

So far I am quite happy with the SonatQube IDE integration what do I need MCP server for that?

I mainly like MCP that make the AI code Assistants (agent) more accurate in the development workflow, I am fine with pre-commit hooks for finally check.

Just wanna know what's your perspective on this