#NoKings in Munich, Germany.
14.06.2025 19:51
👍 1
🔁 0
💬 0
📌 0
#NoKings in Munich, Germany.
Regarding U2F: It is a small detail, but I learned to love the pattern of requiring additional verification for truly sensitive actions. Drastically reduces admin ATO impact.
Not from the US, but is that this “why did the chicken cross the road” thing?
Well well well...
It's all starting to make sense now!
#TACO started by @megancnbc.bsky.social - and she has way too few followers for that, let’s change that.
TACO.
If you read the post about O3 finding a SMB bug in the Linux Kernel, I did a few tests and I what I suspected looks true: Gemini 2.5 PRO can more easily identify the vulnerability. My success rate is so high that running the following prompt a few times is enough: gist.github.com/antirez/8b76...
It’s funny that you can go through 20 years of schooling without ever seeing the idea that writing is a tool for thinking.
YES!
Most companies are getting AI implementation wrong.
They’re focused on using it to *replace* humans rather than *enhance* humans.
The ones that recognize this now will gain a massive lead in this race.
I wrote up some more information on the differences between adding SYS_ADMIN and CAP_SYS_ADMIN to pods in Kubernetes. It highlights some new things I learned about how the CRI you use can affect how pods are run. raesene.github.io/blog/2025/04...
Trustworthy and Responsible AI....it's a real thing!
www.youtube.com/watch?v=fhcY...
I didn't even think about this yet, but linting file- and directory names in project structures makes a lot of sense - and there is of course a tool for it:
ls-lint.org
Alright AKS, pick a lane:
Kubenet: Pods receive IP from an overlay network. Retires March 2028
Azure CNI Standard: Pods receive IP from VNET
Azure CNI Overlay: Pods receive IP from an overlay network.
Great article on using GitHub as a workflow platform:
github.blog/engineering/...
Can absolutely recommend for security workflows and management as well!
Quick note on exploits trying to use `nginx.ingress.kubernetes.io/server-snippet`: That annotation has been identified as an issue before and has been disabled to mitigate CVE-2021-25742.
Quite some #IngressNightmare #CVE-2025-1974 PoCs on GitHub now that look good at a cursory review:
github.com/hakaioffsec/...
github.com/yoshino-s/CV...
github.com/Esonhugh/ing...
github.com/hi-unc1e/CVE...
github.com/lufeirider/I...
github.com/zwxxb/CVE-20...
github.com/rjhaikal/POC...
I wrote up some details on exploiting #IngressNightmare #CVE-2025-1974:
www.averlon.ai/blog/kuberne...
Where are we at with releasing a full PoC?
Great #IngressNightmare CVE-2025-1974 write-up:
securitylabs.datadoghq.com/articles/ing...
Key point missing from many other sources: Exploitation from Internet is non-default and unlikely, but privilege escalation within cluster is by default possible.
Last week we launched a free webapp that shows the tens of thousands of UK companies whose ownership is being hidden, in most cases unlawfully.
It's now easier to use, faster, and has way more features. Quick thread.
TIL that because the FFmpeg project has gained so much experience in hand-writing assembly code to provide huge speedups, they now are putting together a series of lessons for learning assembly:
Vibe coding is fun and all, but this is probably a better use of time!
github.com/FFmpeg/asm-l...
Wow, GitHub not supporting IPv6 for Webhooks:
docs.github.com/en/webhooks/...
In an effort to bring here what little of value is still on the birdsite, allow me to present some absolutely bonkers corporate espionage, in which Deel's execs had a spy at rival Rippling. The complaint is a gripping must-read! rippling2.imgix.net/Complaint.pdf
I updated my #Kubernetes resource exhaustion testing tool to include inode exhaustion:
github.com/uchi-mata/do...
Trump vs Gov of Maine.
Watch this
German elections on Sunday as well, we might well join you in that sentiment 😅
