HN user
Absolutely loving the functionality KEP-4412 brings to kubernetes.
Having the pods service account token passed to the credential provider allows for seamless authentication with private registries.
Before you either had to use the node identity which in some cases isn’t oidc based or create a bunch of imagePullSecrets.
Code and walkthrough at https://github.com/cloudsmith-io/cloudsmith-kubernetes-crede...
I could use a vpn but I already pay for my broadband connection and shouldn’t have too.
Not a solution for shared multi factor auth but maybe some ideas…
- the root account should not be used. Disable it from being able to do anything with an SCP
- new accounts created with aws organisations by default have a random password and no mfa. Access is granted by going through the password reset process. Switch to this process for existing accounts, randomise all the passwords, grant break glass access via password resetting (ensure your contact details are valid). The password reset typically requires access to the email account (make it accessible via SSO) and potentially a phone call, ensure a virtual phone number is used and root holders can point it at their phone.
- use the likes of azure ad, keycloak or okta to store your organisations identities. Require MFA on them via yubikey. Enable access to multiple aws accounts via aws sso.
- for ssh access switch to using aws ssm.
Sad, frustrated, bitter & angry to have been apart of this. Started the job on April 4th, casual 1:1 with my manager on May 26th turned into HR stating it’s over. Not even one months severance as a good will gesture.
Why does bad planning on your part need to result in stress, anxiety, and financial concern for me?
The market is thankfully in a good place and I’m good at what I do. Did atleast one interview activity with 20+ places, it was hell, busier than a average work day. To get to final around it took 6-8 hours of interview activities.
It would be amazing to see companies that are struggling to hire to create a fast tracked interview process for those laid off.
My bet is you could remove the user. Do some DNS messing about either on your router or hosts file to drop all communications to goguardian and then resign into your sons account.
The end result will be that the school management scripts will still run but they’ll be unable to fetch and install goguardian.
Before someone claims its fake, here's a bit of detail about what happened behind the scenes https://twitter.com/imduffy15/status/1329575923310604295
checkout https://info.scrapinghub.com/en/in-depth-analysis-and-evalua... to see how it compares with Diffbot, newspaper3k, readability-lxml, dragnet, boilerpipe and html-text.
The demod used case is a silly one that makes zero sense, but instead of asking why, think, what else is possible.
For most peoeple the act of brushing their teeth marks waking up or going to bed.
With such data exposed and combined with timing data you could trigger morning or night time routines. For example, the toothbrush transitioning from running -> idle after 8pm and before 4am could cause the bedroom to go into sleep lighting (gold at 40% fading out over 15 minutes), all other lights to be turned off, all smart plugs turned off, house alarm set to armed, heating turned off and so on..... or I could just continue to be silly and turn it into a TV controller https://twitter.com/imduffy15/status/1256954852996939777
Used https://m5stack.com/products/stick-c myself
Code can be seen on this commit https://github.com/imduffy15/esphome/commit/90c3cb62b37e9ce3... there are likely bugs :D
Can help fill in some of the blanks for you. The toothbrush has bluetooth. Its bluetooth advertisement contains information about its operating state (running, idle, etc.), mode (brush, daily clean, etc.), pressure and some other things. The ESP32 chip scans bluetooth, detectes these advertisements, parses them and extras the data. It then sends it over to home-assistant.io which can use the data to trigger actions on any other connected device.
https://scrapinghub.com/guides/web-scraping-best-practices/ may be of interest to you.
There are AI solutions that can work on the HTML and manage to avoid the ads. Checkout https://blog.scrapinghub.com/extracting-clean-article-html-w...
I hate this paid support model. I don’t want to have to pay to tell a company I think they screwed up.
https://scrapinghub.com/autoextract may help you with this, it will provide the article in a structured form which you can then diff.
I've been working remotely for just over 6 months. Haven't had much negatives, all summarised in this blog post https://ianduffy.ie/blog/2019/09/11/6-months-of-working-remo...
Unsure about your specific framework/language, but I've done this in the past with spring boot and java.
Spring provides a mocked OAuth2 server that you can bring in for test purposes and do whatever you need to do https://stackoverflow.com/questions/29510759/how-to-test-spr...
Follow up post for anyone that is interested... You've got root, can you get more access to the users azure account? The answer is yes. http://ianduffy.ie/blog/2016/11/27/azure-bug-bounty-root-to-...
Perfect! Thank you Anthony, colloquialism slipping into my English.
That is very interesting @joneholland. Can you tell me more about the RHUI log collector? I thought it was something hand rolled.
That would be correct since GPG checking is disabled. Would just be a case of bumping the version number and releasing a package under the same name.
That is correct..... I've another post I'll do in a few days that details how you can become storage account admin from being root on an instance.
I'm not fully confident that they have actually been rotated....
The bounty was paid out, leaving the amount as undisclosed but it was under 3500 USD.
Debatable @shshhdhs, I can confirm they locked down access but I'm not confident the certificates were actually rotated. It would have meant they would have needed to push new SSL client certs out to every customer Red Hat Enterprise Linux Virtual Machine.
I'm confident that duplicating the virtual disk, certificates or installing the documented RPMs will result in repository access without being billed accordingly. It is considered fraud and I would imagine if one took large advantage of one would be disciplined accordingly.