Archive

NewsletterNewsletter
[tl;dr sec] #75 - IAM Least Privilege at Speed, Spectre, and How to Beat a Grandmaster at Chess

[tl;dr sec] #75 - IAM Least Privilege at Speed, Spectre, and How to Beat a Grandmaster at Chess

How Netflix enables development velocity + security with ConsoleMe, Spectre PoC and proposed defenses, and why speed is a superpower.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #74 - Building Securely on AWS, Non-fungible Tokens, Deepfake tools

[tl;dr sec] #74 - Building Securely on AWS, Non-fungible Tokens, Deepfake tools

AWS security for small teams & Well-Architected resources, NFT overview, tools for creating and detecting deepfakes.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #73 - JSON Woes, Career Advice, and Blub Studies

[tl;dr sec] #73 - JSON Woes, Career Advice, and Blub Studies

JSON libraries parse differently and that can lead to bugs, a number of career advice resources, and how to become compoundingly more effective.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #72 - Finding Access Control Bugs, Supply Chain Security, Security Logging in AWS

[tl;dr sec] #72 - Finding Access Control Bugs, Supply Chain Security, Security Logging in AWS

Tips + a Burp extension for finding access control issues, tools and reflections on supply chain security, an architecture for multi-account security logging in AWS.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #71 - Securing CI/CD, Electron Security, Growing Your Userbase by Ignoring 'Virality'

[tl;dr sec] #71 - Securing CI/CD, Electron Security, Growing Your Userbase by Ignoring 'Virality'

Tips and best practices for securing your CI/CD pipeline, Electron tooling and dangerous APIs, what to focus on instead of virality to grow your userbase.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #69 - Cloud Security Table Top Exercises, Finding RCE in ExpressJS, InSpec for GKE

[tl;dr sec] #69 - Cloud Security Table Top Exercises, Finding RCE in ExpressJS, InSpec for GKE

Valuable cloud security scenarios to think through, leveraging the Handlebars templating engine for local file read or RCE, check your GKE cluster against CIS.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #68 - Securing Lambda, Recon Tool Primer, Blind SSRF Chains

[tl;dr sec] #68 - Securing Lambda, Recon Tool Primer, Blind SSRF Chains

How AWS secures Lambda, Daniel Miessler's overview of @TomNomNom's recon tools, how to demonstrate high impact when you can't see the SSRF response.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #66 - Automating Infra as Code Creation, Container Security++ with User Namespaces, #RustLyfe

[tl;dr sec] #66 - Automating Infra as Code Creation, Container Security++ with User Namespaces, #RustLyfe

A tool to create IaC from an existing AWS environment, container defense-in-depth with user namespaces, rewriting things in Rust.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #65 - Lesser Known AWS Attacks, Infra as Code Scanning, Template Injection Workshop

[tl;dr sec] #65 - Lesser Known AWS Attacks, Infra as Code Scanning, Template Injection Workshop

Scott Piper shares how he'd attack AWS, a survey of infra as code scanning tools, free workshop on server-side template injection.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #64 - Kubernetes Guide, XSS for PDFs, SolarWinds FTL

[tl;dr sec] #64 - Kubernetes Guide, XSS for PDFs, SolarWinds FTL

[tl;dr sec] #64 - Kubernetes Guide, XSS for PDFs

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #63 - OWASP, Fuzzing, and a New 'AWS Swiss Army Knife' Tool by Netflix

[tl;dr sec] #63 - OWASP, Fuzzing, and a New 'AWS Swiss Army Knife' Tool by Netflix

New OWASP security testing guide and GraphQL cheat sheet, new fuzzing research, and a tool to ease administration of complex AWS environments.

Clint Gibler
Clint Gibler
NewsletterNewsletter
[tl;dr sec] #62 - Leaking IAM Users and Roles, AI, and Exploiting Dynamic Renderers

[tl;dr sec] #62 - Leaking IAM Users and Roles, AI, and Exploiting Dynamic Renderers

A tool to sneakily enumerate all IAM users and roles in a target AWS account, recent events in AI, and how to attack server-side renderers.

Clint Gibler
Clint Gibler
FirstBack
1718192021222324
Next Last