dagrz

Author here. There's no complaint. It's an observation rather than an absolute good or bad. It's something you have the consider in designing your application.

How would you feel if an attacker could read your AWS resource tags? Turns out they can! We’ve found a way to enumerate various metadata from public resources and created a tool to help you test your environment.

Author here.

There's been a lot of great work recently on hacking Github-AWS OIDC integrations but I've think we've undersold how bad it is. Here's my guide to finding all the vulnerable roles in all public repos, including new commits in real time.

For those that aren't aware, it's devastating for anyone affected. You give an AWS role permission to be assumed by Githuab Actions, only you misconfigure it not to match the repo or org name. The result is a classic confused deputy, where any repo in Github can assume your role.

This applies to everything you do which depends on review.

Want a particular job? Put in more effort than everyone else. Create a ‘I want to work for you’ website. Be prepared at the interview. Understand everything about the organisation. Quote its founders.

Want to have your paper accepted? Do a little research about what they are looking for. Contact the reviewers directly and ask for help. Get your article reviewed by people who have been accepted previously.

Want to have your RFQ response win? Read the requirements carefully. Make the reviewers jobs very easy. Address criteria directly and clearly. Ask questions.

I am consistently surprised by how little effort the average person puts in to any reviewed endeavour. It really doesn’t take that much effort to stand out.

Author here - As an information security manager at a large organisation, this scares me. As much as we train our users and put governance structures in place to help them do the right thing, they don't always make the right decisions and we can't expect them to. LinkedIn is encouraging some really poor behaviour here and putting both itself and other organisations at risk.

This is awesome. I don't know much about typography but every time I try to learn something, I give up pretty quickly because of the overwhelming amount of (boring) information. I love how this guide is set out in easy to read and consume chunks that flow well from each other.