mastodon 4.8.0-alpha.3+glitchContainers, Security, Kubernetes, Hillwalking
If you're using GCP and have enabled Gemini on any of your projects, this one is worth reading, as you may have some checking to do. https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
Next in my series of blogs on unpatchable Kubernetes vulnerabilities is out. This time it's about TOCTOUs and SSRF
https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2020-8562/
Some Sunday morning thoughts on the rise of personal software and the implications for security.
https://raesene.github.io/blog/2026/05/10/personal-software-and-baremetalvmm/
One of the points I make in Kubernetes Security a lot is that talking about security defaults is hard as each distribution has its own idea of what works for their users.
One of the most surprising of these is Microk8s' choice to not enable RBAC by default. I wrote up a bit about it, here. https://raesene.github.io/blog/2026/03/11/microk8s-rbac-default/
Kubernetes SIG-Security docs have been doing some work to refresh the OWASP Kubernetes Top 10, to help cluster operators and users have a clear idea of where to start with Kubernetes security. It's taken a little longer than expected, but we have our draft top 10 out now. Any feedback very welcome
As the hardware price hikes start impacting server hosting costs, could be a good time to look out those old laptops and desktop you're hoarding (or that could just be me) and see if you can self-host!
I have a feeling that we're entering an era of "personal software" where people write and run their own tools just intended for their personal use.
With all of the activity on coding agents like Claude code, it's interesting to see what impact it will have on the software market. It's always been a bit true that selling software to developers or IT professionals is tricky as they have the temptation to just build their own, and I can really see LLMs accelerating that trend.
To provide a concrete example, a tool I've wanted for years is one that lets me create firecracker backed micro-VMs on my local host so I can test things out and try tools that might be malicious in a more isolated environment than you get with standard Linux container isolation.
Unfortunately that's not a use-case that the firecracker project are really focused on and while there are some tools that look at this area, none of them really seem complete. It's also not an area of programming that I'm familiar enough with to try and code, but I know the problem domain well.
So I thought I'd try out Claude code to see if it could work it out, and honestly it's gone surprisingly well. I've now got something that works for me and has pretty much all the functionality I need. I've probably spent half a day prompting, reviewing, and testing.
Now is this a tool I'd recommend other people use.... no. But it does what I need and I'm expecting it to be pretty useful for my work! If you want to see it, the code is here https://github.com/raesene/baremetalvmm
Just released another entry in my blog series looking at the unpatchable vulnerabilities of Kubernetes.
Whilst the CVEs are quite old, understanding them is useful, both to understand if you need to apply mitigations and also for some of the low-level Kubernetes implementation details they involve.
https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2020-8561/
Really looking forward to Securi-Tay from the Abertay Ethical Hacking Society tomorrow.
If you're there and interested in hearing what 20 years of speaking experience has taught me and how you can hopefully improve your next talk, I'm on at 11:30am in track 3!
