The Vercel breach: OAuth attack exposes risk in platform environment variables
from trendmicro.com
259
by
queenelvis
8h ago
|
|
|
Article:
60 min
The Vercel breach highlights the risk of OAuth-based attacks and platform-level compromises, exposing customer secrets at scale. The incident demonstrates how third-party OAuth applications can bypass traditional perimeter defenses, leading to silent lateral movement within platforms. Key takeaways include the importance of treating OAuth apps as third-party vendors, eliminating long-lived secrets, and designing systems that assume provider-side compromise.
This breach highlights the need for enhanced security measures in cloud platforms and emphasizes the importance of treating OAuth applications as third-party vendors with persistent access to sensitive data, potentially leading to stricter regulations on platform security.
- Compromised third-party OAuth application enabled access to Vercel’s internal systems.
- Impact amplified by Vercel's environment variable model, where non-sensitive credentials were readable with internal access.
- Publicly reported leaked-credential alert highlights detection-to-notification latency as a critical risk factor.
- Attack fits broader 2026 convergence pattern of targeting developer-stored credentials across CI/CD, package registries, OAuth integrations, and deployment platforms.
Quality:
The article provides a detailed analysis of the incident, including technical insights and implications for security practices.
Discussion (97):
22 min
The comment thread discusses the security incident at Vercel, focusing on issues like environment variable exposure, OAuth token vulnerabilities, and AI tool misuse. Opinions vary on the effectiveness of obfuscation as a security measure, the role of cloud platforms in data breaches, and the impact of AI tools on cyber threats.
- Security-by-obfuscation is a layer of defense
- Sensitive secrets should never be exported into the process environment
- OAuth apps and OAuth tokens need better protection against unauthorized access
- Vercel's security posture is questionable, with sensitive data exposed for months
- AI tools are being misused and can lead to AI-accelerated tradecraft
Counterarguments:
- Security-by-obfuscation is ridiculed because it provides no protection when an attacker is motivated.
- OAuth tokens can still be used even if they are not tied to a specific client or have limited scope.
- Vercel's security posture was compromised due to internal mismanagement and lack of proper access controls.
Security
Data Security, Cloud Security, Authentication & Authorization
CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
from brex.com
71
by
pedrofranceschi
10h ago
|
|
|
Article:
CrabTrap is an LLM-as-a-judge HTTP proxy designed to secure AI agents in production by evaluating and approving or blocking requests against a policy in real time. It offers quick setup, open-source access, and a demonstration of its functionality.
CrabTrap's implementation could enhance the security of AI systems, potentially leading to more secure and reliable AI applications in various industries.
- CrabTrap's role in securing AI agents
- Integration with HTTP requests
- Dynamic policy enforcement
Quality:
The article provides clear information without overly promotional language.
Discussion (13):
2 min
The comment thread discusses various opinions on security measures for agentic workflows, particularly focusing on the use of LLMs. There is a debate around whether adding an LLM layer enhances or detracts from overall system security and if probabilistic systems provide adequate protection.
- Security for production agentic workflows should be prioritized
- Adding non-LLM layers can enhance security
Counterarguments:
- Non-LLM layers do not necessarily make the system less secure
- The concept of LLM-as-a-judge can be beneficial as an additional layer of security
Software Development
Security, Open Source, Artificial Intelligence
Windows Server 2025 Runs Better on ARM
from jasoneckert.github.io
22
by
jasoneckert
2d ago
|
|
Article:
11 min
The article discusses an experiment where the author installed and tested Windows Server 2025 on a Snapdragon X Elite system running Windows 11 on ARM, comparing its performance to that of an Intel Core i9 system. The results showed that the ARM-based system performed faster in terms of service startup times, management console opening speeds, and task completion times for typical Windows Server services.
ARM64 could potentially play a larger role in Microsoft's server product strategy as it offers better performance-to-cost ratio compared to x64 systems, especially in cloud environments.
- The Snapdragon X Elite system delivered steady, sustained performance without high boost clocks.
- Modern Intel CPUs tend to have more variability in scheduling and latency under load.
- ARM64 version of Windows Server may use more modern, optimized binaries compared to the x64 version.
Quality:
The article provides a detailed analysis of the performance differences between Intel and ARM-based systems running Windows Server, supported by data from Performance Monitor and PowerShell tests.
Discussion (6):
The comment thread discusses server optimization techniques, Microsoft's shift towards Linux in their product strategy, and the perceived legacy status of MSSQL. There are differing opinions on the future direction of Microsoft's server products and the relevance of MSSQL compared to other databases.
- Typical approach on an HV server
- Keeping the CPU from seesawing can have big improvements
- The future product strategy is clear, it's Linux for servers
- MSSQL or Server 'legacy'
- It's not a dominant database anywhere on the outside
Counterarguments:
- But you’re not going to do that in a lab/personal machine, usually
Software Development
Operating Systems, Cloud Computing
Laws of Software Engineering
from lawsofsoftwareengineering.com
817
by
milanm081
14h ago
|
|
|
Article:
8 min
This article provides an overview of various laws and principles in software engineering that guide team organization, architecture design, quality assurance, planning, and decision-making processes. It covers topics such as Conway's Law, Premature Optimization, Hyrum's Law, The Boy Scout Rule, YAGNI (You Aren't Gonna Need It), Brooks's Law, and others.
These principles guide the development process, ensuring that software is designed efficiently, effectively, and sustainably, potentially leading to better user experiences and more reliable systems in various industries.
- Conway's Law: Organizations design systems that mirror their own communication structure.
- Premature Optimization (Knuth's Optimization Principle): Premature optimization is the root of all evil.
- Hyrum's Law: With a sufficient number of API users, all observable behaviors of your system will be depended on by somebody.
- The Boy Scout Rule: Leave the code better than you found it.
- YAGNI (You Aren't Gonna Need It): Don't add functionality until it is necessary.
- Brooks's Law: Adding manpower to a late software project makes it later.
- Gall's Law: A complex system that works is invariably found to have evolved from a simple system that worked.
- The Law of Leaky Abstractions: All non-trivial abstractions, to some degree, are leaky.
- Tesler's Law (Conservation of Complexity): Every application has an inherent amount of irreducible complexity that can only be shifted, not eliminated.
- CAP Theorem: A distributed system can guarantee only two of: consistency, availability, and partition tolerance.
- Second-System Effect: Small, successful systems tend to be followed by overengineered, bloated replacements.
- Fallacies of Distributed Computing: Eight false assumptions that new distributed system designers often make.
- Law of Unintended Consequences: Whenever you change a complex system, expect surprise.
- Zawinski's Law: Every program attempts to expand until it can read mail.
- Dunbar's Number: There is a cognitive limit of about 150 stable relationships one person can maintain.
- The Ringelmann Effect: Individual productivity decreases as group size increases.
- Price's Law: The square root of the total number of participants does 50% of the work.
- Putt's Law: Those who understand technology don't manage it, and those who manage it don't understand it.
- Peter Principle: In a hierarchy, every employee tends to rise to their level of incompetence.
- Bus Factor: The minimum number of team members whose loss would put the project in serious trouble.
- Dilbert Principle: Companies tend to promote incompetent employees to management to limit the damage they can do.
- Parkinson's Law: Work expands to fill the time available for its completion.
- The Ninety-Ninety Rule: The first 90% of the code accounts for the first 90% of development time; the remaining 10% accounts for the other 90%
- Hofstadter's Law: It always takes longer than you expect, even when you take into account Hofstadter's Law.
- Goodhart's Law: When a measure becomes a target, it ceases to be a good measure.
- Gilb's Law: Anything you need to quantify can be measured in some way better than not measuring it.
- Murphy's Law / Sod's Law: Anything that can go wrong will go wrong.
- Postel's Law: Be conservative in what you do, be liberal in what you accept from others.
- Broken Windows Theory: Don't leave broken windows (bad designs, wrong decisions, or poor code) unrepaired.
- Technical Debt: Technical Debt is everything that slows us down when developing software.
- Linus's Law: Given enough eyeballs, all bugs are shallow.
- Kernighan's Law: Debugging is twice as hard as writing the code in the first place.
- Testing Pyramid: A project should have many fast unit tests, fewer integration tests, and only a small number of UI tests.
- Pesticide Paradox: Repeatedly running the same tests becomes less effective over time.
- Lehman's Laws of Software Evolution: Software that reflects the real world must evolve, and that evolution has predictable limits.
- Sturgeon's Law: 90% of everything is crap.
- Amdahl's Law: The speedup from parallelization is limited by the fraction of work that cannot be parallelized.
- Gustafson's Law: It is possible to achieve significant speedup in parallel processing by increasing the problem size.
- Metcalfe's Law: The value of a network is proportional to the square of the number of users.
- DRY (Don't Repeat Yourself): Every piece of knowledge must have a single, unambiguous, authoritative representation.
- KISS (Keep It Simple, Stupid): Designs and systems should be as simple as possible.
- SOLID Principles: Five main guidelines that enhance software design, making code more maintainable and scalable.
- Law of Demeter: An object should only interact with its immediate friends, not strangers.
- Principle of Least Astonishment: Software and interfaces should behave in a way that least surprises users and other developers.
- Dunning-Kruger Effect: The less you know about something, the more confident you tend to be.
- Hanlon's Razor: Never attribute to malice that which is adequately explained by stupidity or carelessness.
- Occam's Razor: The simplest explanation is often the most accurate one.
- Sunk Cost Fallacy: Sticking with a choice because you've invested time or energy in it, even when walking away helps you.
- The Map Is Not the Territory: Our representations of reality are not the same as reality itself.
- Confirmation Bias: A tendency to favor information that supports our existing beliefs or ideas.
- The Hype Cycle & Amara's Law: We tend to overestimate the effect of a technology in the short run and underestimate the impact in the long run.
- The Lindy Effect: The longer something has been in use, the more likely it is to continue being used.
- First Principles Thinking: Breaking a complex problem into its most basic blocks and then building up from there.
- Inversion: Solving a problem by considering the opposite outcome and working backward from it.
Quality:
The article provides a comprehensive overview of various laws and principles in software engineering, which can be useful for developers and IT professionals.
Discussion (415):
1 hr 48 min
The discussion revolves around a collection of software engineering 'laws', with users expressing mixed opinions on their relevance and applicability in modern contexts. There is debate about the interpretation and utility of these principles, especially regarding performance optimization and architectural design choices. The community also discusses issues related to static website hosting services, highlighting scalability challenges. While there is some agreement on certain points, the overall tone indicates a high level of debate intensity.
- Some of the laws are outdated or misinterpreted
- The collection adds useful context
- Many 'laws' are more like heuristics
Counterarguments:
- Some users defend certain laws, arguing they are still relevant despite modern changes
- Others suggest that the collection could be improved by including more recent perspectives on software engineering principles
- Feedback on potential improvements to the site's infrastructure for better scalability and reliability
Software Development
Architecture, Design, Quality Assurance, Planning, Decision-Making
Framework Laptop 13 Pro
from frame.work
905
by
Trollmann
7h ago
|
|
|
Article:
The article provides advice on how to prevent malware infections when using personal or shared networks.
- Run an anti-virus scan on personal devices
- Ask network administrators to check for misconfigured or infected devices
Discussion (506):
1 hr 29 min
The discussion revolves around the new Framework laptop model, focusing on its Linux support, battery life, keyboard layout, and price. Users appreciate the modularity and repairability of the device but express concerns about battery performance on Linux, keyboard design for developers, and the high cost compared to other laptops with similar specifications.
- The laptop supports Linux well
- Battery life on Windows is impressive but could be better on Linux
- Keyboard layout may not suit developers
Counterarguments:
- Concerns about battery life on Linux
- Criticism of keyboard layout for developers
Security
Cybersecurity, Networking
Cal.diy: open-source community edition of cal.com
from github.com/calcom
148
by
petecooper
7h ago
|
|
|
Article:
44 min
Cal.diy is an open-source, self-hosted scheduling platform forked from Cal.com with enterprise features removed. It's fully MIT-licensed and designed for individuals who want full control over their scheduling infrastructure without commercial dependencies.
Users have full control over their scheduling infrastructure, potentially leading to more personalized and secure solutions.
- Users need to be comfortable with server administration, database management, and securing sensitive data when self-hosting.
Discussion (39):
7 min
The comment thread discusses Cal.com's decision to go closed source, with many users expressing skepticism about its security benefits and suggesting it might be a business strategy. The conversation also delves into comparisons between open-source and closed-source security measures, as well as alternative open-source calendar applications.
- Closing the source code is not an effective security measure
- Cal.com's decision to go closed source is a business strategy, not a genuine security measure
Counterarguments:
- Closing the source code may shield companies from public scrutiny, which could be seen as a form of security theater.
Software Development
Open Source, Web Applications, Scheduling Software