I discovered a 9.8 critical exploit in ZeroMQ with mostly pure luck

Re:I discovered a 9.8 critical exploit in ZeroMQ with mostly... by samtheprogram on Thursday April 11, 2024 @02:53PM (#40005524)

> internal, but by design usually accessible on the public internet

Your API can be accessible obviously, but put ZeroMQ behind a firewall so only the API server can reach it.

If it’s running on the same server, at least block the port ZeroMQ is listening on from the outside world.

[ Parent | on HN ]

Re:I discovered a 9.8 critical exploit in ZeroMQ with mostly... by fragmede on Thursday April 11, 2024 @03:11PM (#40005704)

People make fun of Kubernetes or "resume driven development" for making things more complex than they need to be, but this is why you want mTLS via a sidecar with short auto renewed certificates on a mesh inside your distributed system of a operating stack, when the system is big enough to justify that complexity. Something the size of, like, Airbnb should have that.

[ Parent | on HN ]

Re:I discovered a 9.8 critical exploit in ZeroMQ with mostly... by theamk on Thursday April 11, 2024 @04:14PM (#40006366)

Or a wireguard VPN. Or even just socat with mTLS inside systemd.

There are easier ways to achieve that than kubernetes with sidecar mesh.

[ Parent | on HN ]