A security engineer blog
If you've ever worked in a company that goes through SOC2, ISO27001, or similar audits, you know how tedious is to collect evidence. Screenshots of admin consoles, security configurations, access controls, all captured manually, one by one, every single time an auditor or a customer asks for them. This was a perfect fit for automation, so I built a tool to handle the whole process. Table of…
We’re approaching the usual performance review/promotion cycle and I wanted to write a short post with a few advice that worked for me. I tested them on myself and they helped me move forward in my career. I don’t claim these are universal truths or that they’ll work for everyone or every role, only that they’re practices I believe in and that helped me. Table of Contents Table of Contents Advice…
A Love Letter to RSS RSS represents a relic from a bygone era, a golden age when the Internet thrived as a free and anarchistic space, unregulated and pristine, unpolluted by the disease of bots. At first glance, subscribing with an email may seem innocuous. Yet, each time we provide our email, we relinquish control and our personal data. Modern Web is engineered around The Algoritm™ , optimized…
Another set of improvements for Eleventy blog, mostly focused on reading experience, continiung from the previous post Improving Eleventy blog . Table of Contents Table of Contents Improvements Scroll to the top button Progress Bar Read Time Adjust Table Looks Improvements A few small quality of life improvements for Eleventy blog; nothing major and with this i think i'm done with adding features…
This blog post explain how to add Giscus to Eleventy blog, as a simple and convenient way to have a comment section. Table of Contents Table of Contents Why Giscus Adding Giscus Generate Giscus Configuration Create Giscus JS file Edit Posts Template Adjust Theme Why Giscus Though not everyone wants to have a comment section, comments can provide a nice addition to a blog. That said, there aren't…
Intro I’ve been thinking about this topic for a while and finally got inspired after reading this article: https://www.seangoedecke.com/how-to-influence-politics/ . I agree with much of the author's view, but it feels narrow: it's very technical and realistically doable mainly at Staff level or above. I believe you can influence a company at any level , even as a junior or intern, though there’s a…
Our security team provides support to other lines of business and can be contacted about any security-related issue. Recently, the product and development teams asked about SMS OTP which was a great chance to show how we approach these requests. The hint is threat modeling, which I plan to cover in a dedicated blog post one day. Table of Contents Table of Contents The Problem Threat modeling…
Recently i decided to do some minor improvements over the Eleventy base blog that i am using here to give it a nicer feeling. Table of Contents Table of Contents Improvements Blog image Favicon Light/dark theme switcher Improvements Add a little blog icon One day i thought about adding a little icon next to the blog name on the top bar (where you now see "Luca-san" at left in the bar. Just thought…
While testing a web application with Burp suite, I encountered the issue: Communication error / Stream failed to close correctly and found out this might be a bug in the underlying HTTP Java implementation. Sadly I couldn't definitely confirm this is really the cause, which is disappointing, but that's the impression I was left with after troubleshooting. If you found this blog post afer searching…
In this post I’m going to show you a quick and easy way to use the AWS command line to filter and download data from Inspector. Jumping near the conclusions, here’s a one-liner that gives you a csv-like output filtering on certain fields: ( echo "Severity,Title,Status,Instance,Type,Exploit,Fix,Age" && aws inspector2 list-findings --query 'findings[*].{Severity:severity, Title:title, Status:status,…