I politely suggest that a security focused tool should not further the curl|bash pattern.
[deleted]
Kubescape – tool for testing if Kubernetes is deployed securely
21–30 of 104 posts
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#22I politely suggest that a security focused tool should not further the curl|bash pattern.
There is debate on whether this is really a security concern. [0] https://www.arp242.net/curl-to-sh.html [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...
There is a vast community who thinks it's bad, and unsafe (with examples on how to detect direct piping to bash in order to serve malware) and a few ones condoning it. That seems like saying there is currently a debate on the roundness of the planet Earth.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#23Earlier quoted context omitted.
If you could check for container signing and providence on all materials and make sure that only a single registry is being used (ex only `internal.company.com:443`) and make sure it's not possible to schedule pods with unsigned/untrusted containers that would be awesome.
interesting, I'll send that to our dev team. BTW - you can suggest these things on Kubescape page @ Github and see status etc.
[deleted]
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#24Does the NSA/CISA advice differ significantly from CIS? KubeBench does a great job of CIS assessment.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#25Earlier quoted context omitted.
What alternative pattern would you suggest?
binary packages, maybe through github releases. debian packages, potentially upstreamed into the package repos (though that's some effort). It's quite presumptive to presume to know how a target system is to be configured. no matter which alternative, curl|bash is security risk enough to never use: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... gpg can help (below from zerotier): curl -s ' https://ra…
What's the advantage of binary packages through GitHub releases? How do you audit them?
I'm aware of the fact that you can detect curl | bash server-side, and it's a neat trick, but I don't understand the security risk of it. The server is supplying you with arbitrary content that you're not auditing - what does it matter if it supplies you different arbitrary content?
What's the advantage of the GPG approach? Last I checked, the GPG command was capable of signing malicious binaries.
I do agree about the configuration argument. But that's not a security argument.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#26Earlier quoted context omitted.
There is debate on whether this is really a security concern. [0] https://www.arp242.net/curl-to-sh.html [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...
There is a vast community who thinks it's bad, and unsafe (with examples on how to detect direct piping to bash in order to serve malware) and a few ones condoning it. That seems like saying there is currently a debate on the roundness of the planet Earth.
Right. Actually, since it's hard to tell if the earth is round y observation, I'd say it's more like a debate on whether the Sun goes around the Earth. You can just look up in the sky and see it move - the folks saying otherwise are obviously cranks. There's no need to listen to their arguments.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#27Earlier quoted context omitted.
binary packages, maybe through github releases. debian packages, potentially upstreamed into the package repos (though that's some effort). It's quite presumptive to presume to know how a target system is to be configured. no matter which alternative, curl|bash is security risk enough to never use: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... gpg can help (below from zerotier): curl -s ' https://ra…
What's the advantage of binary packages through GitHub releases? How do you audit them? I'm aware of the fact that you can detect curl | bash server-side, and it's a neat trick, but I don't understand the security risk of it. The server is supplying you with arbitrary content that you're not auditing - what does it matter if it supplies you different arbitrary content? What's the advantage of the GPG approach? Last I…
I think you may be conflating the application owner and the delivery system. If we're installing the application I think we're implicitly trusting the author.
If you copy/paste http instead of https then you've given execution control to every single middlebox along the way.
If the code is hosted on an evil sourceforge, then you've given them execution control.
deb packages will do signature checks, any many authors will list checksums in their releases which we can use to verify.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#28This tool is great! Ran through all these checks and deployed them to our cluster the other day.
Immutable fs & non-root is easier than I thought to deploy with k8s, going to be looking into privilege drops this week too.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#29This tool is great! Ran through all these checks and deployed them to our cluster the other day. Immutable fs & non-root is easier than I thought to deploy with k8s, going to be looking into privilege drops this week too.
thanks a lot! let us know if you have any comments or ideas
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#30Earlier quoted context omitted.
There is a vast community who thinks it's bad, and unsafe (with examples on how to detect direct piping to bash in order to serve malware) and a few ones condoning it. That seems like saying there is currently a debate on the roundness of the planet Earth.
Right. Actually, since it's hard to tell if the earth is round y observation, I'd say it's more like a debate on whether the Sun goes around the Earth. You can just look up in the sky and see it move - the folks saying otherwise are obviously cranks. There's no need to listen to their arguments.
It's not hard to tell if the earth is round by observation. You only need feet, a stick, and brains.
About your second observation, please keep it quiet. We have more than enough with the flat-earthers. We do not need another cult.