There's CIS KubeBench and OpenSCAP as other comments mentioned.
I don't trust an organization that keeps Zero days to themselves for offensive capabilities.
Kubescape – tool for testing if Kubernetes is deployed securely
41–50 of 104 posts
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#42There's CIS KubeBench and OpenSCAP as other comments mentioned. I don't trust an organization that keeps Zero days to themselves for offensive capabilities.
They just made a list of things to check for. Use more than one checklist to get the best coverage.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#43Earlier quoted context omitted.
What alternative pattern would you suggest?
binary packages, maybe through github releases. debian packages, potentially upstreamed into the package repos (though that's some effort). It's quite presumptive to presume to know how a target system is to be configured. no matter which alternative, curl|bash is security risk enough to never use: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... gpg can help (below from zerotier): curl -s ' https://ra…
A binary download is almost worse.
Edit: and why even more silent downvotes?
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#44Kubernetes? God forbid! Very few companies have mastered this technology, and frankly, no one needs it. That such a testing tool is necessary confirms my assumption. Security is now outsourced.
Unfortunately on HN unnecessary complexity is workshipped.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#45Re: Kubescape – tool for testing if Kubernetes is deployed securely
#46I politely suggest that a security focused tool should not further the curl|bash pattern.
There is debate on whether this is really a security concern. [0] https://www.arp242.net/curl-to-sh.html [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...
There is "debate" on whether vaccines give you autism... I mean, debate existing doesn't make it a good idea or not worthy of criticism..
Most people who eschew curl|bash as being a fine thing rely quite heavily on the notion that TLS is infallible.
But there's a lot more dangerous to it than that; half-downloaded scripts or scripts which check your useragent and change content depending on the method of download.
It's just a stupid foot gun, best to avoid aiming guns at feet.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#47There's CIS KubeBench and OpenSCAP as other comments mentioned. I don't trust an organization that keeps Zero days to themselves for offensive capabilities.
They just made a list of things to check for. Use more than one checklist to get the best coverage.
It's not a list, I won't be executing a shell script from a organization that cares about having zero day exploits.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#48Earlier quoted context omitted.
They just made a list of things to check for. Use more than one checklist to get the best coverage.
It's not a list, I won't be executing a shell script from a organization that cares about having zero day exploits.
The linked repo isn't from the NSA, it's from armosec. Who, afaict, don't have zero days in their possession.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#49Earlier quoted context omitted.
There is debate on whether this is really a security concern. [0] https://www.arp242.net/curl-to-sh.html [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...
There is a vast community who thinks it's bad, and unsafe (with examples on how to detect direct piping to bash in order to serve malware) and a few ones condoning it. That seems like saying there is currently a debate on the roundness of the planet Earth.
Considering this practice is in widespread use, I think you might be overestimating the vastness of this "community" (community of what? anti pipe-to-shell community?) "More people are saying A rather than B" is not an especially convincing argument in the first place.
Comparisons with flat earthers is just insulting.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#50Earlier quoted context omitted.
It's not a list, I won't be executing a shell script from a organization that cares about having zero day exploits.
The linked repo isn't from the NSA, it's from armosec. Who, afaict, don't have zero days in their possession.
Sorry misread ... You are right. Still, I will not execute a shell script from a github repository to find security issues ...