kmcquade
Joined 7 years ago
Karma
381
Submissions
45
Member since
Oct 15
Recent submissions
Comment · 1 year ago
Comment · 3 years ago
Depot is freaking awesome. Sped up two of our Docker image builds from 11 minutes to 1-1.5 minutes and the drop-in Docker build replacement in GitHub Actions was super easy. Can't imagine our CI/CD system without it.
Comment · 4 years ago
Love using Depot. The speed improvements are insane
Comment · 5 years ago
> the tool can discover incorrect configurations that would allow someone who extracted the key to change permissions of the bucket.
Nit: The tool can discover and abuse excessive permissions.
Comment · 5 years ago
Yes, you'd have to leverage compromised credentials. That could be obtained via SSRF, RCE on a privileged box, leakage of user access keys, or other means. In the context of a penetration test, it's more of a post-exploitation tool.
Comment · 5 years ago
Aw, thank you. I really appreciate that.
Comment · 5 years ago
Great feedback! I will update the docs accordingly.
Comment · 5 years ago
Not sure. I did uncover a ridiculously destructive approach to abusing Azure Service Principals in CI/CD pipelines that deploy infrastructure in Azure (Confused Deputy problem): https://kmcquade.com/2020/11/nuking-all-azure-resource-group...
for sub in `az account list | jq -r '.[].id'`; do \ for rg in `az group list --subscription $sub | jq -r '.[].name'`; do \ az group delete --name ${rg} --subscription $sub --no-wait --yes; \ done; done;
Comment · 5 years ago
Dry run as default is a good idea. I'll open a GitHub issue for that.
FWIW, if you run `endgame smash` with `--service all`, then it spits out a huge "WARNING" in ASCII art with an explanation and a confirmation prompt.
But I agree, we should have dry-run on by default.
Zero chance I'd sign up for their competitors knowing how good the product is and that everyone else follows them. I don't know why Docker, JFrog, or GitHub don't just buy them already.