"Cmon, what are the odds?" I'll say, as I click the button and record the change absolutely nowhere.

bsky.app/profile/amen...

Make sure to do the good shit on Signal, not here.

lol, my hometown poison has broken containment.

The vitamin/nutritional values of Enuf is completely wacky. Years ago a roomie of mine had to cut way down after blood work and a doctor visit because of it. It was basically the WKUK "Hot Dog" sketch but for Dr. Enuf stubbies.

The GitHub Action "google-github-actions/auth" is my fave silent killer for static creds GCP creds and I've encountered leaks from it dozens of times in the wild. Writes creds to the pwd, which then get silently "COPY ." into the image. README points out .dockerignore but it doesn't enforce/warn...

Gonna flog this dead horse since this mirrors my experience with GCR and other registries: BUILD CONTEXT LEAKS ARE EVERYWHERE (and OCI images are the absolute worst offenders). You're probably doing it _right now_.

had a nyquil dream that was just my brain trying to workshop bootleg shirt mashups of ikiru and akira.

all bart ska-mpson level disasters.

The tech at large has the memory of a goldfish. This crew just got a partnership with Dreamworks: amenbreakpoint.com/posts/zigazoo/

Putting users into a shittier security posture because a single REST API doesn't work like all the other ones sucks.

> "To use the REST API to manage GitHub Packages, you must authenticate using a personal access token (classic)."

I've reported like 10 leaked PATs from packages to their owners in the last couple of weeks and it's kinda bs this issue (from 2022!) is open has been added & removed from the GitHub Public Roadmap 3 times.

imo any PAT's a disaster waiting to happen, call that shit "Chekhov's Token (classic)".

"Yesterday’s flexibility has become today’s insurmountable technical debt."

Put it on my tombstone.

I've seen a TON of ways to fuck up Docker/OCI image builds and leak build context, secrets, etc. but I just reported one to a vendor that I've never seen before: they leaked a GitHub PAT through the build _provenance attestation_ and they'd been leaking multiple tokens for a few years (!). Wild.

Aaaaand Firebase claims another one. The misconfig rate for Firebase/appspot buckets and Firestore DBs has gotta be one the worst for a "turnkey" system.

Today I'm publishing my writeup about a number of security issues I reported last September to Zigazoo, the self-described "World's Largest Social Network for Kids!".

Impact included access to all user records, uploaded media (inc deleted items), account escalation, and user impersonation.

DEATH BEFORE DMARC

jazz is the brown notes you _don't_ play