p932

Briefly mentioned in the article is Erik Demaine (http://erikdemaine.org/).

You can find a lot of resources on his website among which lectures on the topic of Origami folding and algorithms. http://courses.csail.mit.edu/6.849/fall20/lectures/

E-banking security. Configured a dedicated hardware laptop with default network policy outgoing to denied. Manually configured a very limited set of IPs for the banks sites used (no DNS server allowed, static resolution in /etc/hosts) and OS packages. Second step (or factor) done on a dedicated phone hardware too (no sim card used). Automatic browser startup at session open with tabs open for the banks website.

Been operational for a few years. Minimal maintenance. Great peace of mind.

Worth to mention in the same area regarding authorization engine with APIs is OPA [1] which is relying on a Datalog inspired language: Rego.

I agree with you that authorization is lacking a set of standards allowing interoperability. The only known practical one XACML, has not seen wide adoption. OPA through its design and API allow useful feature for Enterprise use cases for which Styra [2] (founder of OPA) is selling a solution based on those APIs.

Note: I am not affiliated with Styra in any way.

[1] https://www.openpolicyagent.org

[2] https://www.styra.com/

Your quote seems to be describing what Microsoft observed from the attackers on the compromised machines with SolarWinds Orion not how the software was compromised in the first place.

See detailed version: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance...

> In actions observed at the Microsoft cloud, attackers have either gained administrative access using compromised privileged account credentials (e.g. stolen passwords) or by forging SAML tokens using compromised SAML token signing certificates.

> Although we do not know how the backdoor code made it into the library, from the recent campaigns, research indicates that the attackers might have compromised internal build or distribution systems of SolarWinds, embedding backdoor code into a legitimate SolarWinds library with the file name SolarWinds.Orion.Core.BusinessLayer.dll.

Is there any initiative in this direction towards applying this pattern on big dependency management tools (e.g maven, pip, npm)?

How this compares with https://github.com/theupdateframework/notary?

How this pattern/toolset protect against supply chain compromises of the dependencies used to build the "Datadog Agent" itself?

Thanks for the links. Do you know how this toolset helps to mitigate/prevent what is called in the GitHub blogpost "Supply chain compromises". Quickly checked around and couldn't find anything that applies to the dependencies of applications/binaries before they land into the target runtime (i.e k8s).

Disclaimer would be welcomed that you are author at Kontena and working at the company selling this propriety tool.

Currently if you have only access to a namepsace on a shared Kubernetes cluster without cluster wide admin control you won't be able to:

- Create cluster wide RBAC ClusterRole or ClusterRoleBinding

- Create or get access to cluster-scoped resources (nodes, CRD)

- Use custom webhooks for example using sidecar injection

Many of the things that complex Kubernetes deployments are doing nowadays.

Gardener project focus is orchestration of multiple Kubernetes clusters on IaaS cloud providers, whereas k3v focus on running a dedicated control plane over an existing Kubernetes cluster. Some overlaps but different project's goals.

Sorry about a bit off-topic and not directly answering your questions but your story resonated with my experience. Maybe it might help you or not :)

I've had surgeries on both my eyes for retinal detachment before I was 22 years old (30ish now). I am now handling myopia of -16 due to bad eyes and post-surgery effects. I don't want to insinuate that you have the same conditions but I dealt with similar symptoms. Sudden loss of vision, dark circles and dark drops passing in the vision is a scary and distraught feeling.

The thought process you describe happened to me as well and is still in-progress. Dealing with the fact that having such issues "early" in life poses questions and anxiety for what might happen later. I kind of navigated over the years with two ways of dealing with this. First as you today with the ideas of pro-active actions to prepare for the day I might go blind: learning braille, using a computer without or very poor sight and thinking about possible career transitions.

I was lucky enough that the surgeries went well and my sight "kind of" stabilized. Over the years I adopted a more "optimistic" approach. Even with a bad start, it is still only a possibility and not a certainty to become blind. I decided to live my life as fully as possible with my current sight and avoid to end-up in a anxiety circle about it. Who knows I might still have my sight for life. And by the time it might deteriorate, technology and medical science will have improve, thus hopefully increasing the chances in treatment, tools and possibilities.

Good luck for everything.

You should definitely get a proper plane ;). k

Apparently RedHat does:

http://www.serverwatch.com/server-news/red-hat-growing-milli...

https://investors.redhat.com/~/media/Files/R/Red-Hat-IR/docu...

Datahand are also an alternative to traditional keyboards: http://octopup.org/computer/datahand

Some bits of Fran Allen in Coders At Work book: http://www.codersatwork.com/fran-allen.html

"We were making so much good progress on optimizations and transformations. We were getting rid of just one nice problem after another. When C came out, at one of the SIGPLAN compiler conferences, there was a debate between Steve Johnson from Bell Labs, who was supporting C, and one of our people, Bill Harrison, who was working on a project that I had at that time supporting automatic optimization. The nubbin of the debate was Steve’s defense of not having to build optimizers anymore because the programmer would take care of it. That it was really a programmer’s issue"

"We have seriously regressed, since C developed. C has destroyed our ability to advance the state of the art in automatic optimization, automatic parallelization, automatic mapping of a high-level language to the machine. This is one of the reasons compilers are . . . basically not taught much anymore in the colleges and universities. "