CitySec Mayhem presentations playlist "Five Ways To Fail At Crime, Spotting the Storm: Attack Detection in the Cloud, Hunted: From Wanted Blackhat to Celebrated Whitehat, Plug - Silver Sparrow And The Tale Of The Mysterious Insu File, Forensics Crash Course, Find & kill your WordPress intruder with bare hands (and logs)"
Take a Ride With Me "Watch cyclists ride down hill form the comfort of your own saddle. Better with sound on. Website takes forever to load, so open in background, and check on it in a minute." (from Weekend Reading)
kubernetes-simulator "A distributed systems and infrastructure simulator for attacking and debugging Kubernetes: simulator creates a Kubernetes cluster for you in your AWS account; runs scenarios which misconfigure it and/or leave it vulnerable to compromise and trains you in mitigating against these vulnerabilities." (from Cloud Security Reading List)
Meet Stretch from Boston Dynamics "Prototype of robot designed to automate box moving tasks in warehouses and distribution centers: unloading trucks, building pallets of boxes and order building. Stretch makes warehouse operations more efficient and safer for workers."
lazydocker A simple terminal UI for both docker and docker-compose, written in Go with the gocui library.
Codetour "CodeTour is a Visual Studio Code extension, which allows you to record and playback guided walkthroughs of your codebases. It's like a table of contents, that can make it easier to onboard (or re-board!) to a new project/feature area, visualize bug reports, or understand the context of a code review/PR change."
Responsively "Develop responsive web apps 5x faster! A must-have DevTool for all Front-End developers."
Permissions A simple site to test permission-related UI for web APIs.
Simulator Status Magic "Modify the iOS Simulator so that it has a perfect status bar, then run your app and take perfect screenshots every time."
Software often consists of not just your own code but also is dependent of third party libraries and other software which has their own update cycle and new versions are released now and then with fixes to vulnerabilities and with new features. Now the question is what is your dependency management strategy and how do you automate it?
Fortunately automated dependency updates for multiple languages is a solved problem as there are several update tools to help you: Renovate, Dependabot (GitHub), Greenkeeper ($), Depfu ($) and Dependencies.io ($) to name some alternatives. In this blog post I will concentrate on using Renovate and integrate it with GitLab CI.
Renovate your dependencies
Renovate is open source tool which works with most git hosting platforms (public or self-hosted) and it's possible to host Renovate Bot yourself. It’s installable via npm/yarn or Docker Hub.
In short, the idea and workflow of dependency update tools are following:
Checks for updates: pulls down your dependency files and looks for any outdated or insecure requirements.
Opens pull requests: If any of your dependencies are out-of-date, tool opens individual pull requests to update each one.
Review and merge: You check that your tests pass, scan the included changelog and release notes, then hit merge with confidence.
Now you just run the depedency update tool on regular basis on your continuous integration, watch how the pull requests fly and you get to keep your dependencies secure and up-to-date.
The manual chore of checking for updates, looking for changelogs, making changes, running tests, writing pull requests and more is now moved to reviewing pull requests with better confidence of what has changed.
Self-hosted in GitLab CI
Renovate Bot is a node.js application so you’ve couple of alternative ways to run it on your CI/CD environment. You can use a node docker image which installs and runs renovate, or you can use Renovate Bot's own Docker image as I chose to do. We are using docker-in-docker approach of running the Renovate docker container. That means you can start Docker containers from within an other Docker container.
First create an account for the bot on the Gitlab instance (the best choice) or use your own account. Then generate a personal access token with the api scope for renovate to access the repositories and create the branches and merge requests containing the dependency updates.
Then create a repository for the configuration and renovate will use that repo’s CI pipelines. Paste your Gitlab token under CI / CD > Variables as a new variable and give it the name RENOVATE_TOKEN. Set it to protected and masked to hide the token from the CI logs and to only use it for Pipelines starting on protected branches (your master branch is protected by default).
You'll also need a Github access token with the repos scope for renovate to read sources and changelogs of dependencies hosted on Github. It’s not important what Github account is used as it's just needed because Github's rate-limiting would block your bot making unauthenticated requests. Paste it as an other variable with the name GITHUB_COM_TOKEN.
To configure Renovate we need to add three files to our repository:
repositories.txt for repositories we want to check:
.gitlab-ci.yml to run renovate:
# Because our GitLab runner doesn’t have TLS certs mounted and runs on K8s
- docker run -e RENOVATE_TOKEN="$RENOVATE_TOKEN" -e GITHUB_COM_TOKEN="$GITHUB_COM_TOKEN" -v $PWD/config.js:/usr/src/app/config.js renovate/renovate:13 $(cat repositories.txt | xargs)
Now everything is finished and when you run the pipeline renovate will check the repositories in repositories.txt and create merge request if a dependency needs to be updated.
The first merge request to repository is Configure Renovate which helps you to understand and configure settings before regular Merge Requests begin.
As a last step create a Pipeline Schedule to run the pipeline every x hours or x day or whatever you like. You can do this in the bot's config project / repository under CI / CD > Schedules by creating a new schedule and chosing the frequency to run your bot.
Congratulations! You’ve now automated the dependency updating with GitLab CI. Just keep waiting for the merge requests and see if your test suites are successful. If you are really trusting your test suite, you can even let renovate auto-merge the request, if the pipeline succeeds.
Your Thinking Rate Is Fixed "You can’t force yourself to think faster. If you try, you’re likely to end up making much worse decisions. Here’s how to improve the actual quality of your decisions instead of chasing hacks to speed them up." (from Hackernewsletter)
Best practices for REST API design "In this article, we'll look at how to design REST APIs to be easy to understand for anyone consuming them, future-proof, and secure and fast since they serve data to clients that may be confidential." (from Hackernewsletter)
Uizard "The design tool for everybody. Scan a paper scribble and you get a wireframe. Upload images and it will extract color and style to generate a matching theme." (from Weekend Reading)
Camo Camo makes you look great on Zoom by using your iPhone as a webcam. You can control lighting, cropping, focus, Bokeh effect, stream 1080p with no stutter (needs cable), use front-facing, telephoto or wide lens. (from Weekend Reading)
OWASP Top 10 for Web "Inspired by real-world vulnerabilities and case studies, we have created a series of interactive application security training modules to help developers understand, identify and mitigate security vulnerabilities in their applications."
Introducing GKE Autopilot: a revolution in managed Kubernetes "Autopilot is a new mode of operation in Google Kubernetes Engine (GKE). Autopilot clusters are pre-configured with an optimized cluster configuration that is ready for production workloads. This streamlined configuration follows GKE best practices and recommendations for cluster and workload setup and security." You can achieve "the same" by manually ticking the right options.
How they SRE A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE) (from Hacker Newsletter)
Tools of the trade
skan "sKan is a Kubernetes configuration files and resources scanner that enables developers and devops team members to check whether their work is compliant with security & ops best practices." (from Cloud Security List)