Look, I'll take being a year behind Filippo as not being too bad.
25.02.2026 20:17
👍 1
🔁 0
💬 1
📌 0
Look, I'll take being a year behind Filippo as not being too bad.
Turns out, I'm the only one who didn't know about the passkey PRF extension. Wrote up a post about using it for end-to-end encryption!
oblique.security/blog/passkey...
Yep!
If two goroutines are blocked by sleeping the same amount of time, then synctest picks which to unblock at random:
go.dev/play/p/J7XMk...
GCP managed certs work by pointing Cloudflare DNS records at your load balancer. Manage both through Terraform and that's hopefully not too terrible when you're spinning up services on new subdomains.
Bad news everyone
I've heard of tougher noogler projects
Surely someone there is smart enough to just implement 802.1x for corp devices?
🚨 Tap and Ride is LIVE! 🚨
Starting today, you can pay for BART right at the fare gates with a 💳 contactless-enabled debit or credit card or use 🤳 mobile payment, like Apple Pay and Google Pay.
There is zero registration or setup process required.
Wrote about a fun @golang.org type trick where APIs can force clients to pass string constants as arguments. Happens to be _extremely_ useful for SQL builders!
oblique.security/blog/injecti...
How can you use a Terraform Provider to automate your Permission System?
Well, that's what @veronicalg.bsky.social is going to tell us in this livestream later today.
It's Office Hours format so bring any questions you may have.
www.youtube.com/live/OlQ70bq...
It turns out workload identity isn't a complete mess in 2025 (only a little one)? Wrote a bit about authenticating GitHub Actions identity directly using OpenID Connect.
Oh hey, what's this fancy new IAM company?
A friend needs a Workday test instance to build something interesting. Anyone know how to get one?
(A Workday instance; I kinda already know how to get a friend.)
We're doing new container runtimes in 2025? Hell yeah
So if I'm reading this right
Step 1 - generate a private key with no forward secrecy
Step 2 - upload private key to twitter (but don't worry it's protected by a low entropy PIN)
Ummmmmmmmm
So that's effectively the AWS story, which is terrible but at least it's possible to cobble together something that works and you can audit. Google looked at this and said "what if we could express how much we hate Infrastructure teams as a service?" Expensive coffee robots were engaged, colorful furniture was sat on and the brightest minds of our generation came up with a system so punishing you'd think you did something to offend them personally.
Every day I'm glad my job isn't staring into the IAM abyss of a large Cloud org.
matduggan.com/iam-is-the-w...
What a sicko
Every time you feel useless, remember that GitHub as a notifications tab
who needs coherent cyber policy when we excel so much at corporate ligation?
www.nytimes.com/2025/05/06/t...
New experimental garbage collector for Go programs! github.com/golang/go/is...
@mayakaczorowski.com's been using it a ton and had great things to say.
📣Today, we’re super excited to announce our latest product addition: Continuous Profiling for GPUs! Check out the use cases and sign up for early access on the announcement post! 🔥📈
www.polarsignals.com/blog/posts/2...
You're not even using nix packages? What kind of tech hipster are you?
Scraping Kubernetes codebases for os/exec continues to pay dividends
www.wiz.io/blog/ingress...
"middleware:middleware:middleware:middleware:middleware" is the new bloody mary
zhero-web-sec.github.io/research-and...
I really wish progressive web apps took off so every app didn't come with a chrome fork
Awesome to see Landlock making unprivileged isolation so easy. As someone who maintained bubblewrap jails, I'm hoping that this takes over user namespaces. Things like network controls are always mess there.
github.com/Zouuup/landrun
Quick reminder:
Was it petty? Yes. Was it necessary? Also yes.
Quick reminder:
