cateof
ExtraReplica – a cross-account database vulnerability in Azure PostgreSQL
Orgmode clone written in Lua for Neovim 0.5
Fake science: Photoshopping, fraud and circular logic in research
GitFlow Considered Harmful
Security bulletin for recent AWS Glue vulnerability
Re:BreakingFormation: AWS CloudFormation Vulnerability
on Thursday January 13, 2022 @02:59PM (#29925985)
Seems like the AWS Glue exploit [1] discovered by the same team is the more critical one of these two. The CTO of Orca confirmed that they were able to access an admin role in an AWS service account, and from there assume roles in customer accounts with service roles that trust the glue service [2].
1: https://orca.security/resources/blog/aws-glue-vulnerability/ 2: https://twitter.com/yoavalon/status/1481691075672694793
Using Git for Incremental Backups
Statement from AWS regarding recent support role incident
Re:AWS Support able to access any S3 object due to permission change
on Thursday December 23, 2021 @05:10AM (#29660398)
Objects encrypted with S3-managed encryption keys (SSE-S3) are affected, as these keys are set up with a non-configurable resource policy granting the S3 service decryption permissions.
AWS Cloud Development Kit (CDK) v2.0.0 has been released
The Unfulfilled Promise of Serverless
GitHub Actions: Secure Cloud Deployments with OpenID Connect
Bypassing required reviews using GitHub Actions
AWS Lambda now supports ARM64 architecture
The developer guide has been updated with details [1], and you can select the new architecture when creating a Lambda function through the AWS Console. We'll likely see an official statement from AWS soon.[1]: https://docs.aws.amazon.com/lambda/latest/dg/foundation-arch.html