This would be great to have in SOPS. Makes the secret story much better to be able to encrypt for a recipient, without having access to their KMS. This is a pattern we follow, so can't adopt SOPS yet, to encrypt offline without touching the environment. It also allows developers, who do not have privileged access to production environments to pass us secrets for target systems. https://github.com/getsops/sops/issues/684

For anyone interested, I’ve just released a threat intel feed aggregator -dstif.io Feel free to add the rss feed to your own slack/discord/feeds (hint hint @Erik Osterman (Cloud Posse) )

LogoFAIL is a technique to take advantage of image parsing functions that do not properly validate input arguments and allow for buffer overflows in UEFI bootloaders. The attack is to inject a trojan-horse'd vendor logo into the EFI System Partition. Apple devices not vulnerable due to not using UEFI, but others should make sure they check for BIOS updates from their manufacturer.

https://easybreach.dragonsecurity.io Type in a password The client side generates a sha1 hash as you type and the sha1 gets checked against my easybreach api in near realtime, seeded with the hibp password list.

Hi All, Anyone who can recommend a company doing pen-testing of NodeJS frontend, Python backend deployed in AWS. Purpose of the pen-test is audit requirement, but we are also very interested in learning from the experience and validating our internal effort on security.

Hey everyone! Given that 3DES ciphers are susceptible to SWEET32 attacks, I’m on a mission to secure our CloudFront domains. However, I’ve hit a snag: the most up-to-date security policy I can apply is TLSv1.2, which, to my surprise, still supports 3DES. Does anyone know if there’s a method to exclude 3DES ciphers from CloudFront? Alternatively, is there a way to customize the security policy manually? Appreciate any insights or guidance!

yoo anybody know any good alternative to Weaveworks Ignite Firecracker vm -- that has docker images lol (Weaveworks is shutting down apparently)

Hi Everyone! Does anyone know a good alternative to freeipa? Is freeipa the best for managing access to Linux machines?

The open-source project owners who are experiencing mental health issues are the targets of social engineering

when this xz happened at the first time, I got a question on my mind, the English commit messages are so fluent, https://research.swtch.com/xz-timeline. Did the xz owner

Lasse Collin

talked to

Jia Tan

before, either face to face or voice? Did anyone know

Lasse Collin

or see him before? When did ssh include liblzma?

Another `social engineering takeover attempt`: https://therecord.media/researchers-stop-credible-takeover-xz-utils

Excited to share our latest NXT1 blog post by our Co-Founder and CTO, Darren House. In "Redefining Roles in Application Security," Darren explores the need for a shift in responsibility away from end users in securing commercial technologies. He emphasizes the importance of adopting a long-term perspective, integrating GenAI into the development process, and fostering a culture of shared responsibility among educators, industries, and users. Dive into the full article to discover how we can build a safer future together. https://nxt1.cloud/cybersecurity/redefining-roles-in-application-security/?utm_medium=blog&utm_source=communities&utm_term=slack

Hey there, I have been asked to do an assessment of our DevSecOps practices and have been asked to implement hashicorp vault. I am hoping to pick someone's brain on how they have done it for their org. Appreciate the help I can get thanks

Anyone who has a Data Security Questionnaire they can share with me for 3rd party services processing data with AI? I need some inspiration and assurance that I'm covering the basics in our questionnaire

Hi folks, what is everyone doing to get keep their ECR images updated and free of vulns? Looking for new ideas for image pipeline, esp for nervous engineers.

Hey folks, can anyone tell me what devsecops features do Harbor registry provides? Also which would be better choice trow/quay(selfHosted)/harbor for hosting registry. I want to focus more on security aspects

Great talk on how one could bypass a TF plan, along with advanced tips on preventing it. Demo at 23'

has anyone here read up on anthropic.com/glasswing?

I'm checking out the clearwing project as a result of it: https://github.com/Lazarus-AI/clearwing

anyone here tried secretspec.dev ?

Defcon is coming up in a couple of weeks. With AI at fever pitch, mythos, et al, this year should be very interesting. https://defcon.org/