Viewing profile — aeijdenberg

https://github.com/continusec/htvend/ htvend is a tool to help you capture any internet dependencies needed in order to perform a task. It builds a manifest of internet assets need…

I've been thinking a lot about this kind of thing recently - and put a prototype up of htvend [1] that allows you to archive out dependencies during an image build. The idea being …

Thanks for taking a look. The intent was to support basic build systems accessing package eco-systems that tend to always serve the same response for the same URL. Docker registrie…

htvend is a tool designed to make it easy (or at least possible), to build OCI (ie Docker) images, in a more trustworthy and reliable way. That is, in a way that tightly controls w…

The TS doesn't seem to provide for a way to modify return values for the function. For example the following is a common pattern in Go using defer to ensure that errors closing a w…

We use Terraform a lot too - and most of the time it's great, but not infallible. Our team managed to screw-up some pretty major DNS due to a valid terraform plan that looked OK, b…

Slight, but important (if you don't want to run out of fuel) nit, indicated airspeed (KIAS) is not the same as true airspeed (KTAS). To calculate ground speed (as required for navi…

False only for very small values of code. ie if your code itself is split into modules, they won't work (as they are imported by their full path, not relatively), and anything in y…

You can certainly claim something is centralized and tamper-evident. ie demonstrate proof that something has not been mutated over time. See RFC6962 Certificate Transparency logs a…

Not quite as simple as a cryptographic hash alone - remember that if the set of possible inputs can be easily enumerated, then it's trivial to find the input data by brute force. T…

Glad to see any doc published that gets developers thinking more about security... One "trend", or rather bad habit that I've noticed a lot in discussion with other developers rece…

Making a hash of the release is just a small part of it (and is the first part of what they are doing). The trick is to be confident that you're getting the same hash as everyone e…

CT significantly pre-dates the recent Symantec issues, but yes, it does provide an excellent tool for providing evidence of misissuance [0] [1] - and that's the crux of it - in ord…

CT logs are designed to be able to handle queries from all web browsers on a daily / more frequent basis, and the output from queries is easily cacheable (and the logs can be mirro…

If I'm understanding correctly, the plan is to piggy-back on top of the existing Certificate Transparency [0] infrastructure by issuing a regular X509 certificate per Firefox relea…

As I understand it, Chrome (unlike Firefox) does not ship its own root CA store - rather it defers to the root store of the operating system that it's running on. It does however a…

If you're looking to be able to consistently hash JSON objects you might want to look at Ben Laurie's objecthash: https://github.com/benlaurie/objecthash It describes a consistent …

I'd always assumed the primary goal of LinkedIn endorsements is the same as every other email I get from LinkedIn, to keep user engagement with the site - and based on the number o…

What benefits does this approach give above those offered by Certificate Transparency [0]? I was surprised to see no mention of this as related work in either the linked paper or s…

The problem I've found is that when we start using cute tricks like the old "xxx" % locals(), or the newer f-strings, is that we tend to start forgetting basics like escaping the s…

If I recall correctly, don't some older versions of Windows broadcast (as an adhoc network) the SSID of the last hotspot they successfully connected to? [0] If so, wouldn't it be q…

Probably no reason other than that it takes time and resources to go through all the steps necessary to launch in a region (e.g. localization, legal etc), and it's more effective t…

Should such a requirement (CT for private CAs) exist, wouldn't the said laptop vendor simply ship embedded SCTs in their fake certs signed by their own fake log key, also baked int…

So that you (or other interested parties) can verify the correct operation of the centralized authority, and so that the central authority can prove that they aren't hiding anythin…