Slow JSON Stream: 64 connections at 1 B/s takes down PHP/Laravel in under 2 minutes
New DoS attack: 37/41 HTTP frameworks vulnerable by default. 64 connections at 1 byte/s exhausts PHP/Laravel in <2 min. Full PoC + paper + Docker testbed included.
devops
11
Articles
The Saga pattern as the backbone of AI agents that act in the real world
An AI agent doesn't reason, it acts. And when it acts on real systems, you need Saga. Not as an architectural fashion, but as a philosophy of responsibility.
Supabase Auth vs Auth0: The Lie of Easy Authentication and the Real Risk
If you think wiring up OAuth2 with Google is easy, read this before you walk into a mess you won't know how to walk out of. A brutal comparison between Supabase Auth and Auth0.
How on earth does OpenAI (or Anthropic) answer 800 million people at once
Datacenter GPUs, NVLink fabrics, liquid cooling and serving software. This is how an LLM answers you in 2 seconds while 3 million other people are using it.
DevSecOps series No. 3: Old-fashioned issues in DevOps, zip bombs
A zip bomb is a 2001 attack that still works in 2019 and, in an automated pipeline, can reach production on its own. A demo taking down Apache Tomcat with a .war file.
DevSecOps series No. 4: Protecting environment variables in the most well-known CI systems
How Jenkins, GitHub Actions, GitLab CI/CD and Bitbucket Pipelines store secrets, and how to use them so production credentials never end up in a log.
Enhancing SSH server security: configuring OTP for SSH access
How to add a one-time password (OTP) as a second factor to your SSH server with libpam-google-authenticator on Ubuntu or Debian, step by step.
The butterfly effect on research
A talk at Navaja Negra 2023 taught me that WAF-Brain, a proof of concept we built at BBVA, had become the base of research papers written on the other side of the world.
FreeBSD Pot vs Docker A Technical Comparison
In this article, I will share my opinion on FreeBSD Pot vs. Docker based on my experience using both tools.
Creating Docker Containers as Build Agents for Jenkins using SSH
The aim of this doc is to guide over the process to set up Docker Containers as Build Agents for Jenkins. It's very common to consider Jenkins nodes and agents as synonyms, but strictly speaking are not the same. A Jenkins node, also known as a Jenkins server, is any machine (physical or virtual) connected to the Jenkins network or the Jenkins environment. Nodes provide computational resources and environments to execute Jenkins build jobs. Both controllers and agents are considered to be nodes. In summary, we can say that Jenkins Nodes are the machines on which Agents run. By using docker containers as agents, you can reduce and simplify the process to create agents: every build spins up a new container, builds the project, and is destroyed. A common practice is to create docker containers to execute the app build process. In this doc, we will see how to create those containers.
DevSecOps series No. 1 — Breaking the CI/CD by using evil Git repositories
This is the first post of a serie about DevSecOps. We’ll discuss about (in)security in DevSecOps process. Today we’ll check security in building process when you need external GIT.