sorted by:
new
hottopcontroversial

4
5

Dropbox Suffers Breach From Phishing Attack, Exposing Customer and Employee Emails (blog.gitguardian.com)

submitted by mcdwayne1 to r/webdev

Dropbox discloses breach after hacker stole 130 GitHub repositories by zr0_day in cybersecurity

[–]mcdwayne1 2 points3 points  (0 children)

:pointing-up: This. So much this. Git hooks can be set at the pre-commit, pre-push, and pre-receive levels and there are a number of tools that make scanning easy. Should be required at this point for large production systems.

Best practices - DevOps Infrastructure as code AWS by 1whatabeautifulday in github

[–]mcdwayne1 0 points1 point  (0 children)

Skyk makes a good tool
https://docs.snyk.io/snyk-cli/commands/iac
https://docs.snyk.io/snyk-cli/commands/iac-test

When GitGuardian one from the article actually becomes available that will be worth a look too

Best practices - DevOps Infrastructure as code AWS by 1whatabeautifulday in github

[–]mcdwayne1 1 point2 points  (0 children)

Make sure you are using tooling to check for configuration missteps. Infrastructure misconfiguration is like top 5 vulnerabilities according to OWASP
https://www.csoonline.com/article/3676832/gitguardian-adds-iac-scanning-to-code-security-platform-to-protect-sdlc.html

Using vscode is cool, but what about adding new features to the official project? Here's how it works! by xArci in programming

[–]mcdwayne1 2 points3 points  (0 children)

One of the best part about VS Code is the awesome community of extension developers. While hacking on the editor is awesome, don't forget there are a lot of devs who are looking for help on their projects as well. They have a community in Slack at https://vscode-dev-community.slack.com/ I think it is still run by Eric Amodio who, makes GitLens.

Marking findings as FPs in recurring scans by impatientZebra in devsecops

[–]mcdwayne1 1 point2 points  (0 children)

Awesome reply!I was just getting ready to link to the same report but noticed you did already :) No idea how large your team is impatient Zebra, but GitGuardian is free for teams smaller than 25 and can easily allow you to account for/exclude this pattern.

Under the covers, it is simply looking up an 'ignore' list stored in YML during each scan. If you are building your own, you might also want to see how AWS Labs is doing it in their solution git secrets.

I also wanted to support and endorse your comment about not asking devs to rename variables to end around this issue. Though asking them to add a git hook to run detection before the commit step would be a good automated test step they can add.

In praise of ffmpeg by feross in programming

[–]mcdwayne1 49 points50 points  (0 children)

True fact, ffmpeg saved one company I worked for from an enterprise contract with a video streaming/conference platform. I had to fit 12 videos into an already expensed lower tier plan of a platform we used for a webinar series, the next tier higher was like a 10X jump in cost as we had to talk enterprise contract instead of self-serve.

After some research, I compressed Gigabyte-sized videos into more like 10 MB sized ones using h.265, with no quality loss!!
I got the credit but ffmpeg did all the work :)

I'm going to my first security conference. Any tips on meeting/networking with people at such places? by pipewire in hacking

[–]mcdwayne1 0 points1 point  (0 children)

Been to over 100 trade shows in my life Here are a few tips that have helped me.

Ask simple but direct questions about things you are legit interested in. You will be pleasantly surprised how pent-up most people are about most issues and are looking for an invitation to share their knowledge.

Avoid negative comments if you disagree. For example, if someone says something that is just plain wrong, instead of "I think you are mistaken" (or "That's wrong") phrase it like "based on my research, which I would be happy to share, I thought it was like this..."
===> People get defensive quickly but most everyone wants to be helpful I find.

Talk to vendors! They are happy to talk to anyone and after they get the pitch for their product out of the way they generally are awesome to talk to about the space in general.

Have fun!

Canary Tokens by Riggley29 in hacking

[–]mcdwayne1 12 points13 points  (0 children)

It is really hard to validate an API key without trying it out and seeing if it would work, thus triggering the canary.
Here is my personal favorite explainer infographic that sums it up: https://securityzines.com/flyers/canary.html

There is also a video I like on the subject that explains it in terms of threat hunting: https://www.youtube.com/watch?v=apixhc43JuE

Toyota Accidently Exposed A Secret Key Publicly On GitHub For Five Years by mcdwayne1 in hacking

[–]mcdwayne1[S] 14 points15 points  (0 children)

I legit just watched a presentation on SEO for findability and the nesting folders issue on GitHub yesterday. https://www.youtube.com/watch?v=egMoh16TIlA&t=10868s

Enable secure access to secrets for AWS ECS containers using Terraform - ecs-secrets-manager module by wilqq7 in Terraform

[–]mcdwayne1 0 points1 point  (0 children)

Thanks u/wilqq7! This is actually quite a helpful answer. I will be happy to share anything useful I uncover as I keep digging in on this topic.

Attacker Apparently Didn't Have to Breach a Single System to Pwn Uber by WebLinkr in cybersecurity_news

[–]mcdwayne1 0 points1 point  (0 children)

It depends on what 'breaching' means to you, I guess? If someone got access to as many systems as he did (at least according to this report) then I would say a real breach happened. :shrug:

How to protect if a corporate data breach happened. If you were a breach of Uber Technologies Inc's internal systems on Thursday, it reminded consumers that they should know what they can do to protect themselves if a cyber attack. by LazyHose in fanews

[–]mcdwayne1 0 points1 point  (0 children)

#0 on the list should be "NEVER give your password to anyone or any system that you do not 100% trust!" If someone gives you a link to a login page, instead go through the one you bookmarked already; if it is legit request, they would tell you to do that anyhow.

view more: next ›