Let me start by saying I've been writing Javascript on and off since the early 2000s but I definitely don't consider myself an expert in it, particularly given the rapid iteration of JS best practices and uses. Somewhere between the end of 2020 and mid 2021 I started building an intentionally awful sketch toy app where I reproduced a handful of CVEs I was familiar with in nodejs, and have kept…
Not every company is lucky enough to have enough appsec or even infosec folks that a security staffer can threat model everything. You're on an engineering team who own some services and you've been told by security that you should threat model your system; now what? Since obviously the folks who own the systems have the deepest knowledge of them, this can sometimes turn out awesome. But, for…
Credit Kelly Kaoudis twitter , github John Jackson twitter Sick Codes twitter , github Robert Willis twitter Affected application versions (known as of 6/4/21) 5.13.0 and below (iOS) 5.3.0 and below (macOS) 5.3.0 and below (Windows) 5.10.8 and below (Android) 5.3.0 and below (Linux) Initial test versions (5/13/21) 5.11.0 and below (iOS) 5.1.0 and below (macOS) 5.1.0 and below (Windows) 5.9.7 and…
I am just recently starting to use Docker again after an about six year hiatus from it (used regularly ~2014-2015). I do not recommend following the actions I document here in any way, shape, or form, but wanted to chronicle them in case it's educational for others, or in case I don't use Docker again until 2030 and want to know what worked in 2021. Constructive suggestions or corrections (so I…
I get to look at a lot of resumes as part of my job. Each of these represents a thinking, feeling human being, but after awhile it is very hard not to get picky about what makes it easier for people who don't have a lot of time to spend reading your document to digest it and get the information they need. This blog post is not about the CV. That is a different document. Though there might be…
The main idea of having an oncall, as I understand it, is to share the burden of interruptish operations work so no one human on the team is a single point of failure. I have so far encountered several kinds of dysfunction in implementations of "oncall rotation" and would like to provide some ideas for other folks in similar situations on how to get to a better place. What ownership of code or…