neo2006

5 ms·

1.
by neo2006 5mo ago
This is, for the time being, mostly an experiment. I was able to get consistent results where a diverse community of agents could provide a more accurate answers for tasks that they would fail if asked to perform individually.
2.
Show HN: Raft to allow a group of AI agents to reach consensus(github.com)
2 points by neo2006 5mo ago|1 comments
3.
by neo2006 5mo ago
yes I agree and we actually already do that for TLS when rewriting secrets after encryption but my point is about the fact in our threat model we consider the app as an adversary so we don't want to use any of its buffers to rewrite se
4.
by neo2006 5mo ago
Actually we have 2 applications along those boundaries you described. a webhook app that manage kubernetes manifest and another to inject the ebpf code and manage the ebpf maps. Thank you for the feedback though! I think we need to clarify
5.
by neo2006 5mo ago
Thank you! We are planning to integrate with external secret operators, like AWS secret manager or Openboa/Vault so users can benefit from an end to end secrets protection. secret encryption/sealing at rest (through secrets manage
6.
by neo2006 5mo ago
Thank you! I agree, each architecture have its pro and cons. If an egress gateway is available and can handle secrets it's definitely a viable solution.
7.
by neo2006 5mo ago
I'm not super familiar with TPUs and Trusted execution environments but my understanding is that it serve a different threat model. TEE aim to protect a certain workload from the host to avoid another workload on the same host from ste
8.
by neo2006 5mo ago
For egress proxy the app need to: - send traffic to the proxy (either in a non transparent way or using routes or even ebpf to redirect traffic to the proxy transparently) - trust the proxy certs or use plain http/TCP to the proxy With
9.
by neo2006 5mo ago
This is not something we support currently. We will need to do some research on ways to support it. The main hurdle is that we can't rewrite secrets in any of the user buffers as this will defy our threat model and signing is usually d
10.
by neo2006 5mo ago
The way we thought about it is from the lense of 2 personas: - a persona that control the control plain side, what secret to distribute to which user and what hosts they are allowed to send that secret to (probably platform team or secops t
11.
by neo2006 5mo ago
yes please open an issue on https://github.com/spinningfactory/kloak/issues and we can discuss this. I'm not familiar with secretless-broker but we can definitely see if that use case fit with kloak and get i
12.
by neo2006 5mo ago
Thank you for the feedback! We are currently shorthanded so we relied on AI a lot for writing our docs, we reviewed that doc as much as we could but definitely there is room for improvement. We will try to get better at this. In the mean ti
13.
by neo2006 5mo ago
The main threat model is application leaking secrets: - Internet facing app that could potentially be hacked and bad actor exfiltrating secrets - AI agent that can exfiltrate secrets through prompt injection for example or context poisoning
14.
by neo2006 5mo ago
It was not intended! We were trying to make it sound like a cloak with a kubernetes K but I guess this explanation actually checkout better!
15.
by neo2006 5mo ago
Thank you! We will reachout and see what can be done
16.
by neo2006 5mo ago
yes, that's right!
17.
by neo2006 5mo ago
Thank you! Not really, the controller is not doing dataplane per-say, it only pushes eBPF programs to the kernel for the relevant apps/cgroups so that could be considered control-plane. The full data-plane run in eBPF.
18.
by neo2006 5mo ago
Thank you! We appreciate your enthusiasm! :-) From technology perspective nothing prevent kloak to do rewrite on any workload scheduler or even without a scheduler (native Linux). The main challenge is to find a flow to signal to kloak what
19.
by neo2006 5mo ago
Secrets are detected before encryption in the user buffer but rewrites happen post encryption in the kernel buffer to be sent on the wire. packets boundaries are not an issue because detection happen at the SSL write where we have the full
20.
by neo2006 5mo ago
I guess we are the secrets sewers then! :D We would love to hear what you think about it beyond the name though.
21.
by neo2006 5mo ago
Hey, we're the spinning-factory team, the folks behind Kloak. Kloak runs as a Kubernetes controller. It swaps the secrets in your workloads for harmless placeholders we call kloaked secrets, then uses eBPF to substitute the real secret
22.
Show HN: Kloak, A secret manager that keeps K8s workload away from secrets(getkloak.io)
63 points by neo2006 5mo ago|52 comments
23.
Show HN: gRPC Transport for HashiCorp/Raft(github.com)
2 points by neo2006 8mo ago|0 comments
24.
by neo2006 1y ago
it's not a war Netanyahu is killing innocent people and taking a full population hostage. Also, most of the people in Gaza are not Hamas members and are regular civilians. What Natanyahu is doing is basically analog to the following: A
25.
Langgraph Studio(blog.langchain.dev)
2 points by neo2006 2y ago|0 comments
26.
by neo2006 3y ago
If we want to include the cost of a code review into the equation we should also include the cost of fixing a big that made it to production which is in most of the cases higher then code review. Skill is not a factor here, I work and worke
27.
by neo2006 3y ago
I fully agree, we also do this and this is the design review I alluded to. That said, I think both have different purpose. The design review is more about the approach and the high-level implementation. The code review is about the implemen
28.
by neo2006 3y ago
I often stack PRs to emulate the practice described by Mitchell but it's not ideal as if you need to change an underlying PR l, you need to rebase all of the dependent PRs.
29.
by neo2006 3y ago
I don't see code review as an overwatch but a good communication tool and a way to think about problems collectively. Code review reduce bugs because it permit to have people think about the problem from multiple angles. About decision
30.
Consul API Gateway Now Generally Available(hashicorp.com)
2 points by neo2006 5y ago|0 comments

More ›