backspace

Seal the golden OS Dockerfile to bootc to our registry, Ignition on first boot, and a host that has nothing to drift This is the first deep dive under Harden your servers. Own your trust.  which lays out the full map. You own the trust chain. If a third party is hacked, you should not be owned. For the host, that means the OS your cattle boot is an artifact you built, signed, and served yourself. Two artifacts are the OS source of truth The OS has exactly two authored sources, and both live in our git: An IaC Dockerfile. CI builds it with bootc into a bootable OCI image, signs it, and pushes it to our LAN registry. The Dockerfile plus the frozen golden supply it consumes is the full OS recipe. Our Ignition config for a minimal ostree-based Fedora CoreOS (or a bootc-derived sibling). Ignition runs on first boot, sets identity and hardening, and starts containerized workloads pulled from our registry. Ansible is not the OS source of truth. It orchestrates the herd from CI,...

Harden your servers. Own your trust. How to do security right in the time of AI Agents It's very difficult task to be secure when everybody is acting like "Tony Stark" with his Iron Man suit and JARVIS-like AI Agent. CVE feeds look like weather reports: remote code execution, privilege escalation, sandbox escapes. And this month a public Certificate Authority failed so badly that one private key was the digit 4 . That mess favors attackers. Stacked controls still hold if you treat every layer as disposable and pin the roots yourself. This post is the map. Seal the golden OS ( part 2 ) covers the host; Own the pipeline ( part 3 ) covers supply, CI, and the herd. You own the trust chain. If a third party is hacked, you should not be owned. The eMudhra lesson In October 2026, reporting on the Indian CA eMudhra described private keys for several intermediates that were trivial to guess. One was literally the number 4 ; others were below 256. Anyone who recovered them could...

XZ Backdoor in SSH Background Someone planted a backdoor in XZ compression, which is believed to affect SSH. More details can be found. Although it was never shipped to production version of any distro. Even if you are using unaffected version I suggest you defuse any similar backdoors. https://www.openwall.com/lists/oss-security/2024/03/29/4 https://news.ycombinator.com/item?id=39865810 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users The Kill Switch The backdoor has a kill switch, it does not activate if it detects that someone is observing it (debugger attached...etc). An easy way to defuse the backdoor is to just define TERM environment variable causing the backdoor to think it's being observed and it would disable itself hopefully this is not specific to this backdoor but any similar one.  mkdir /etc/systemd/system/sshd.service.d/ echo -e "[Service]\nEnvironment=TERM=xt...

Introduction For those who study modern literature, there are many known " Literary Elements " (like plot, theme, character, pace and tone, ...) and " Literary Techniques/Devices " ( Flashback , Cliffhanger , Narrative hook , ...) that was developed over time. With regards to story telling, many structural principles of modern storytellers can be explained using analysis based on Aristotle Poetry, where the story is all about a "knot" that get tied or revealed, the play has two parts: complication and unraveling with respect to the "knot". Freytag's Analysis of a store, proposed in 1863 by Gustav Freytag (a German writer) which is a model of an arc of 5 parts: exposition/introduction rising action (rise) climax falling action (return or fall) denouement (catastrophe) Although it's advocated for modern story telling, it's still lakes more advanced structures used by modern story tellers as we are going to see later....

Introduction This weekend I've made a GTK+ application, I've done my best to make it responsive by applying my old Android development experience. Android make it clear that you should not block UI thread (main thread) not non-UI tasks like: disk IO (read a file) network IO (request remote API) internal SQLite database intensive computations  Let me quote : "You should not perform the work on the UI thread, but instead create a worker thread and do most of the work there." private class MyTask extends AsyncTask... { protected Long doInBackground(URL... urls) { // worker thread } protected void onProgressUpdate(Integer... progress) { // ui thread } protected void onPostExecute(Long result) { // ui thread } } GTK+ GTK+ is not threadsafe, in the sense all calls to GTK+ should be from a single thread that is the main thread or the UI thread, which seems similar to Android. We have a class that loads the glade XM...

Docker is awesome, but what is even more awesome about UNIX philosophy is that you can use combine small tools to create a something that work like docker. Actually Dockerlite used BTRFS and LXC to make a toy version of docker. In this post we are going to discuss show how one can pull a Docker image and run the containers without a docker daemon, of course we do this for fun. We are going the achieve the following: ability to pull docker images space efficient  storage of images and containers even better that docker (not just reuse layers, but even files) run the container We are going to use OSTree : content addressable storage, git-like for OS Images, space efficient and uses hardlinks Skopeo : a way to pull all kinds of images and convert them to all kinds of storage Runc (or any OCI runtime like bubble wraps oci ) In this post we are going to run everything as non-root regular user (to make it even more challenging) let's create a bare OSTr...