@InsanityBit

SecEng @tines_hq Previously: SWE @Datadog CEO/ Founder of @graplsec SecEng @Dropbox SWE @Rapid7

 New York
insanitybit.github.io
Joined June 2012
  • Tweets21.2K
  • Following489
  • Followers2.7K
449Media
I honest to god don't care that chainguard broke the php vuln embargo, if you want to call it a break even. I actually don't care if anyone breaks any embargo ever.
1
2
465
PHP owns the vuln, not the vendors scrambling to patch and protect their customers. Point the finger at the *actual vulnerable software*.
105
Good on the vendors who just shut their services down while they sort out the php vuln. That's the right call.
102
Attack surface reduction is very cool but also it's like... the least tractable option. "Oh just build less" yes, yes, I'll totally sell leadership on this when a customer says a feature is required for a sale lol
2
1
5
387
A major step in preventing supply chain worms is to separate "build/test" steps from "publish with creds" steps. In Github Actions this is basically: 1. Job to do build/test. Publish as a github actions artifact. `permissions: {}`. 2. Download the artifact, deploy it.
Socket
@SocketSecurity21h
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
1
1
5
367
This meaningfully changes wormability and it massively reduces blast radius. CI tends to be more privileged than prod (since CI controls prod) and better monitored.
1
33
fulcrumsec.vg/pingcap/ > Four years before we walked in, their own security team had documented that any member of a customer organisation — including a billing-only role — could take over every cluster in that organisation as root Hurts to read. Sorry buds.
2
5
219
Colin O'Brien retweeted
Jon Oberheide
@jonoberheide21h
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
27
210
29
2,375
52,705
Colin O'Brien retweeted
Buswe
@buswe_comOct 20
Replying to @charliermarsh
UV_NATIVE_TLS=true helps here too: uv then reads the system trust store, so OS cert updates reach you between releases.
1
9
956
If I read "update your priors" one more time I'm gonna put it right at the start of my suicide note.
2
104
We just assume this in 3B. Our internet facing service can never see any of the secrets that our service manages for customers, it runs in gvisor, and it can only egress through an authorizing proxy.
Tabletop Scenarios@badthingsdaily21h
An RCE is being exploited in the wild on the same production, internet facing web stack you have.
1
4
198
I'll do a blog post about the encryption at some point but the tl;dr is it's HPKE with a client side encryption key that the server literally never sees.
37
I don't want to call anyone out but a lot of people are trying to reinvent the word "sandbox" and holy shit it's insufferable.
3
198
I tried aggressively splitting a rust project into smaller crates and compile times eventually regressed. smh
1
233
Colin O'Brien retweeted
Brad Spengler@spendergrsecOct 18
1
2
634
Colin O'Brien retweeted
Brad Spengler@spendergrsecOct 18
git.kernel.org/pub/scm/linux… lore.kernel.org/all/20261006… i.blackhat.com/Asia-25/Asia-… github.com/BuSung-dev/Root-M… github.com/pubglite55/oppofi… etc etc
1
1
15
827
Colin O'Brien retweeted
Brad Spengler@spendergrsecOct 18
Yeah I mean it was "probably" already published widely last year, "probably" also reported privately to Linus et al who did nothing about it, "probably" already used in multiple exploits this year, and "probably" already rediscovered by an LLM, but what do I know 🤷‍♂️
2
1
20
3,513
One thing 3B does well - API keys always expire (no extension), the grants are statically scoped, you can only associate them with a service account, the keys are tagged, and they're discouraged. We killed user API keys pre-launch. OIDC and SSO is the standard path.
1
512
I'd love to kill API keys entirely but a lot of services just don't really support OIDC client auth. Still, we give you every opportunity to avoid them and we limit them considerably.
1
65
Load more