Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective

Makes sense -- we're focused on fixing problems over just being yet another Jira ticket generator.

> Found Splunk creds in a log? Awesome, start using them. Syslog in an S3 bucket... boom. You are now hitting the stuff that every other ASM/visualization tool has missed.

This is my dream :). This past weekend I was playing around with something where if I clicked on a SecretsManagerSecret node then it'd give me the CLI commands to assume the roles and then retrieve the secret. It'd be neat to take it a step further and be able to click here and get a shell -- I don't think we're _that_ far off from that (but for now to be very clear we're focusing on read-only actions only since a security tool with permissions to do scary things in your environment kinda defeats the purpose).

[dead]

Yes, that's why I linked to what I did and mentioned IAMSpy because the devil's in the details, especially with things like AWS SSO and OIDC providers, because those represent a whole class of principals that _could_ get into the Role but only a finite number of them that actually do, barring misconfiguration[1]

I think it would probably be unreasonable to say "IAM Conditions when?" in a Launch HN if one had to build those things from scratch. That would be ferociously hard and not a sane ask right out of the gate. But since IAMSpy already exists, and according to you there's some non-trivial amount of IAM evaluation already in Cartography, then what I'm asking is whether you envision your future as one of ("eh, it's good enough", "we're integrating more libraries that attempt to formalize IAM", or "we'll roll our own policy engine in python, how hard could it be")

Further illustrating my point, you linked to a .yaml file with "s3:GetObject" seemingly applied to an S3Bucket saying "can read" but that's for sure not systemically true for a monster list of reasons. I get the impression that Wiz makes their bread and butter on helping people understand when they actually have open S3 buckets and not just giving them a report full of false positives

I do appreciate this can come across as busting your chops, but I don't mean to shit on you, or your product, or your launch. I'm just pointing out that if you put "You can think of us as an open-core Wiz alternative" in the 2nd sentence of your announcement, there is a massive opportunity for expectations being out of alignment unless you have a plan to get from where you are to Industrial Grade Introspection. The other side of that coin is that if you do have the background for it, as your pseudo-resume implied, then it's a massive opportunity to give them a run for their $5 billion, too

1: and it's the misconfiguration that I would want a reasonable tool to chirp about, not "omfg token.actions.githubusercontent.com can get into your Role!"

Not at all, super appreciate the discussion and your detailed read!

> what I'm asking is whether you envision your future as one of ("eh, it's good enough", "we're integrating more libraries that attempt to formalize IAM", or "we'll roll our own policy engine in python, how hard could it be")

It's a combination of 2 and 3. Today we use the policyuniverse library for things like s3 bucket-policies, and we have that self-rolled policy engine described in that blog post I shared. I should've mentioned earlier that this is the first time I've seen IAMSpy, thanks for sharing.

I think we're currently pretty good at permissions evaluation since that feature gives lots of value as it is, but there is a lot more to do. Continuing to improve this and being able to connect that with other data is a priority since it's one of our main value propositions.

> there is a massive opportunity for expectations being out of alignment unless you have a plan to get from where you are to Industrial Grade Introspection.

Industrial Grade Introspection is absolutely the plan. I'll also add that we're especially interested in highlighting cases that involve permissions that go between providers - like Okta->AWS, Opal->AWS, etc - and we intend to be very competitive here.

Hi, interresting goal that you have in mind.

Working in a huge enterprise, I see a clear benefit for this kind of product, as we are really struggeling to keep track.

I understand that you are very early in boot-strapping, but what I was missing while skimming over the videos and links and webpage is a better high-bird view or contextualization of the apporach.

I was considering a demo, but the two options (chat and quick chat) were a bit unclear to me what they would archive / how they are structured.

Again, I have full understanding that you are still working on this. Good luck with this project.