Viewing profile — alexsmolen

I've been using elhaz ( https://github.com/61418/elhaz ) to manage AWS creds locally, and also experimenting with sandboxed (e.g. dangerously-skip-permissions) agents using Docker.…

I've been working on AWS security for years and querying CloudTrail has always been a huge pain - getting data about like "what did this role actually use in the last 30 days?" mea…

I'm working on TrailTool, which aggregates CloudTrail for analysis in both UI and AI contexts. I've always found it tough to tie together CloudTrail logs into meaningful narratives…

In my research I haven’t come across the prior art you suggest exists. The trust centers you linked aren’t fungible with what I’m building with GraphGRC. The idea is to make all yo…

I love this idea despite the real world operational challenges - most people with governance responsibilities in organizations don't want to code, and code is often too precise to …

This is a pretty good article about preventing SSRF including DNS rebinding-based attacks in Go https://www.agwa.name/blog/post/preventing_server_side_reque...

Kind of wild that there's no mention of SSRF. A quick search shows it's a pretty frequent security issue in Webhooks: https://www.google.com/search?q=ssrf+webhook

This is what https://tosback.org/ does, I believe.

Yeah, I think it’s tricky to figure out how to place it somewhere that attackers would look but AWS tooling wouldn’t, by default, since otherwise they may be used in legitimate ope…

I recently helped build a secret store system for our infrastructure, and we decided to not use Vault. A big reason was that Vault’s AWS authentication backend is not based on AWS …

The problem is that SMS provides better recovery rates than TOTP/HOTP + backup codes, because people can go to their carrier and get a new device at the same number. It's important…