2022-03-08: python:3.10.2-bullseye Released

Python publishes puthon:3.10.2-bullseye container image. This is the last Python image before the CVE-2022-0778 OpenSSL vulnerability was fixed.

In the last few months, I started seeing more and more customers using Azure Container Registry (or ACR) for storing their Helm charts. However, many of them are confused about how to properly push and use the charts stored in ACR. So, in this post, I will document a few things that need the most […]

August 18, 2021August 18, 2021toddysm

Signatures, Key Management, and Trust in Software Supply Chains – Part 2: Exploiting Signatures

In Part 1 of the series Signatures, Key Management, and Trust in Software Supply Chains, I wrote about the basic concepts of identities, signatures, and attestation. In this one, I will expand on the house buying scenario, that I hinted about in Part 1, and will describe a few ways to exploit it in the […]

February 8, 2022February 13, 2022toddysm

To 404 or Not to 404 – Using HTTP Response Codes to Provide User-Friendly Error Messages in Microservices Implementation

How often the following happens to you? You write your client code, you call an API, and receive a 404 Not found response. You start investigating the issue in your code; change a line here or there; spend hours troubleshooting just to find out that the issue is on the server-side, and you can’t do […]

September 7, 2021January 9, 2022toddysm

Learn More About Your Home Network with Elastic SIEM – Part 1: Setting Up Elastic SIEM

Last night I had some free time to play with my network, and I ran tcpdump out of curiosity. For a while, I’ve been interested to analyze what traffic is going through my home network, and the result of my test pushed me to get to work. I have a bunch of Raspberry Pi devices […]

June 9, 2020February 21, 2021toddysm

How Can I Successfully Hack My Home Network?

This morning I was looking at our company’s e-mail gateway and cleaning some of the quarantined messages when I got reminded that while my company’s digital infrastructure may be well protected with firewalls and e-mail gateways, my home network can be wide open and vulnerable to attacks. Like everyone else, I try not to spend […]

February 18, 2019February 21, 2021toddysm

Implementing Containers’ Secure Supply Chain with Sigstore Part 3 – Ephemeral Keys and Artifact Promotion

In the last post of the series about Sigstore, I will look at the most exciting part of the implementation – ephemeral keys, or what the Sigstore team calls keyless signing. The post will go over the second and third scenarios I outlined in Implementing Containers’ Secure Supply Chain with Sigstore Part 1 – Signing […]

November 17, 2022November 17, 2022toddysm

2022-03-08: python:3.10.2-bullseye Released

2022-03-15: OpenSSL CVE-2022-0778 Fixed

2022-03-16: debian:bullseye-20220316 Released