pquerna

10 ms·

1.
by pquerna 1y ago
it's happening? "Ex-Intel executives raise $21.5 million for RISC-V chip startup": https://www.aheadcomputing.com/ I believe the founding team is all in Oregon - and mostly all ex-Intel.
2.
Go Supply Chain Attack: fake boltdb(socket.dev)
4 points by pquerna 2y ago|1 comments
3.
by pquerna 2y ago
okta is not "active-active" in a multi-region sense, they run in a single active AWS single Region per-tenant. You can pay extra to have a faster failover in a region level failure scenario: https://support.okta.com&#x2
4.
by pquerna 2y ago
per < https://trust.okta.com/security-advisories/okta-ad-ldap-dele... > 2024-07-23 - Vulnerability introduced as part of a standard Okta release This issue is not an "okta is old" issue. this was new cod
5.
by pquerna 2y ago
Our app < https://www.okta.com/integrations/conductorone/ > is in the Okta OIN ("marketplace") using OIDC? So not sure what you mean by that?
6.
by pquerna 2y ago
This is an Eclipse foundation project, not an Apache Software Foundation (ASF) project? it's all volunteers/open source, but this isn't an ASF project.
7.
IT Workers Infiltrated More Than 300 U.S. Companies, Earning Millions(justice.gov)
7 points by pquerna 2y ago|4 comments
8.
by pquerna 2y ago
What about "access controls" for the AuthZ side, instead of Permissions? Wondering HNs collective wisdom on this-- at work we've been using Access Controls on our homepage for awhile- https://www.conductorone.com&#
9.
by pquerna 2y ago
For this general pattern implemented in Golang, check out redis_rate: https://github.com/ductone/redis_rate This fork also implements Redis Client Pipelining to check multiple limits at the same time, and Concurrency L
10.
by pquerna 3y ago
The API for Let's Encrypt to do this requires possession of the private key, which pwned keys doesn't always have. Sometimes they just have an "attestation" of compromise: https://pwnedkeys.com/submit.ht
11.
by pquerna 3y ago
You can also just, Log the spans as they are being created to stderr/stdout -- I've done this on a previous project with this approach of "spans first". It made it debuggable via output if needed, but the primary consump
12.
by pquerna 3y ago
Yeah, but... shouldn't Github of rotated their keys over the last decade? I mean it seems like its clearly a key that wasn't in an HSM.. and over the lifetime, hundreds? Thousands of Github employees could of accessed it?
13.
by pquerna 3y ago
Would it of been possible for Github to use Host-key rotation instead of hard breaking it? https://lwn.net/Articles/637156/ I'm honestly not familiar with anyone actually using host-key rotation?
14.
SVB Panic(twitter.com)
4 points by pquerna 4y ago|1 comments
15.
by pquerna 4y ago
congrats on the launch! three questions / thoughts: 1) Your post mentions "Ranking", and while do the most impactful work first is great, the method I have most often used is when dealing with Vuln-overload is to "Reclas
16.
by pquerna 4y ago
Its cool to see the automation the kubernetes team stuff does against Github -- but has it been expanded to other resources, eg AWS or some other SaaS used? Other thought I had, is there any concept of expiration of permissions? Something I
17.
by pquerna 4y ago
thank you -- can't edit it anymore, but paul.querna (spelled my own name wrong)
18.
by pquerna 4y ago
i've also been working on a similar tool -- working towards open sourcing it too. would you be interested in taking a look? paul.quenra at conductorone com
19.
by pquerna 4y ago
This is how Okta's Advanced Server Access works: https://www.okta.com/products/advanced-server-access/
20.
by pquerna 5y ago
hello. i added support for httpd to support systemd socket activation in 2013: https://svn.apache.org/viewvc?view=revision&revision=1511033 httpd can start as non-root, assuming other configurations like the access &#x2
21.
by pquerna 5y ago
At a $previous_job I basically also did what the post is describing. The "best" thing we did was actually using a "template database": https://www.postgresql.org/docs/14/manage-ag-templatedbs.ht
22.
Big Ass Data Broker Opt-Out List(github.com)
3 points by pquerna 5y ago|1 comments
23.
by pquerna 5y ago
> In June 2012, he became an advisor and received options for shares in the company Sumo Logic, Inc. The next month, Kail authorized and signed on behalf of Netflix a vendor agreement between Netflix and Sumo Logic. Few months later: h
24.
Panther Going Closed Source(blog.runpanther.io)
1 points by pquerna 5y ago|0 comments
25.
by pquerna 5y ago
there are ongoing changes to allow ed25519, eg, see: https://csrc.nist.gov/publications/detail/fips/186/5/draft
26.
by pquerna 6y ago
There are some mundane, and totally fine goals in here. But midway through, there is some really broad and overreaching concepts. When the goal is "No Unilateral Changes to Critical Software", this implies that there is "one&
27.
Know, Prevent, Fix: A framework for vulnerabilities in open source(opensource.googleblog.com)
2 points by pquerna 6y ago|1 comments
28.
by pquerna 6y ago
1) You return SUSPENDED instead of OK from your handler. See also http://svn.apache.org/viewvc?view=revision&revision=1593860 2) You can control all response filters at the byte level with an Output Filter. 3) Hooks alr
29.
by pquerna 6y ago
in a hilarious turn of events (to me at least), I was one of the primary developers of the event mpm.
30.
by pquerna 6y ago
Hello. I'm not a QEMU developer. I used to be pretty active in Apache HTTPD, APR and related projects. They are large user space code bases written in C - with, overall, a relatively OK security record. I think Apache should be on a

More ›