#securityishard

[dieswaytoofast]

If you’re using containers today, and you can’t rebuild everything with the push of a button, you’re not really using containers - you’re running a custom #Linux distribution. And that is a *bad* idea - you will, forever, be (many?) steps behind the vulnerabilities curve. Automating your CI/CD/CT toolchain is not just about efficiency, it's *critical* for #security. #DevOps

[dieswaytoofast]

Project Wycheproof - a collection of unit tests that detect known weaknesses of some cryptographic algorithms. This is good, because #CryptoIsHard. OTOH, despite the warning below, I can easily see more (most?) devs going "Cool, I can now haz my own crypto" "Passing the tests does not imply that the library is secure, it just means that it is not vulnerable to the attacks that Project Wycheproof tries to detect. Cryptographers constantly discover new weaknesses in cryptographic protocols"

[dieswaytoofast]

Security Is Hard - Part the Millionth aka: "You got #OAuth2 right, but screwed up your trust vectors" “The root cause of this vulnerability is a common, but misplaced trust in the authenticating information received by the 3rd party app’s backend server from its own client-side mobile app, which in turn, relies on potentially tampered information obtained from the client-side mobile app"