Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
veganism.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Veganism Social is a welcoming space on the internet for vegans to connect and engage with the broader decentralized social media community.

Administered by:

Server stats:

293
active users

veganism.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0-alpha.5

#programming

284 posts228 participants14 posts today
Public *
ReynardSec

A grumpy ItSec guy walks through the office when an exchange of words reaches his ears.

Dev0: Hey, this isn't working, I hate containers...
Dev1: Maybe just add the --privileged flag!

ItSec: Just… no. Simply no. No privileged mode - the grumpy fellow interjects as he walks away.

Dev0: Jesus, fine - no privileged mode.
Dev1: Okay, but… why?

Here's why (one, simple example): 

Docker's --privileged flag lifts almost all restrictions from your container - exactly the opposite of --cap-drop=ALL. Let's demo the difference. 

1) Start two containers.

docker run -itd --privileged --name ubuntu-privileged ubuntu
docker run -itd --name ubuntu-unprivileged ubuntu

2) Inspect /dev in the unprivileged container.

docker exec -it ubuntu-unprivileged bash
ls /dev
exit

You'll only see a limited set of devices. No disk access. 

3) Now inspect /dev in the privileged container.

docker exec -it ubuntu-privileged bash
ls /dev

/dev/sda exposed! Sometimes you may see /dev/mapper when LVM is in place. Then "apt update && apt install -y lvm2" and "lvscan" may help during next phase.

4) Exploitation part (inside the privileged container) - simply mount mount /dev/sda to any writable path in container.

mkdir /tmp/whatever
mount /dev/sda1 /tmp/whatever

5) You can now enumerate - and access - the Docker host's logical volume.

ls -la /tmp/whatever

6) If you wish, you can even chroot into the host:

chroot /tmp/whatever /bin/bash

The moral of the story is to avoid privileged mode, because in the event of an incident (e.g. an attacker compromising an app running inside a container), you significantly increase the likelihood of successful lateral movement from the container to the Docker host - and from there into the rest of your infrastructure.

Usually the grumpy guy means well. He just doesn't know how to explain it properly.

#devops#programming#webdev
Public
Blender Dumbass ( J.Y.Amihud )

From: blenderdumbass . org

The multiplayer, or the lack there of, at the moment is so utterly broken and so lacking of being properly made that for a long time, I was just not bothering with it. Seeing it as something unnecessary. Something that does not need to be touched, because other things, like the...

Read or listen: blenderdumbass.org/articles/a_

blenderdumbass . orgA Rant About Making a Multiplayer Game
More from Blender Dumbass ( J.Y.Amihud )
#Gamedev#DanisRace#Networking
Public
Martin Owens :inkscape:

DX.

Why did it take me so long to think of DX instead of trying to say "you know, UX but for library APIs"

Now I can just say: Hey FontConfig, you have terrible DX!

(I have long pushed on the idea that design is a required skill for programming *code*, not just GUIs or even CLIs, but the code itself should be designed too)

#UX#DX#foss
Public
argv minus one

When your program reads a configuration file, and that configuration file contains paths to other files, those paths need to be resolved relative to the parent of the realpath() of the configuration file!

In particular, do not:

* Resolve them against the current working directory of the process

* Forget to realpath() (that is, resolve symbolic links in) the path to the configuration file

This has been a public service announcement.

#programming
Public *
mort

Uh. Why does initializing a C++ 'std::array' with an initializer list work differently from initializing a 'std::vector' or a C array with an initializer list?

For the std::array, the compiler complains that it can't initialize a pair from an int, as if it treats '{1, 2}' as its own array. It works with an extra pair of braces that's not necessary for std::vector and C arrays.

What dark corner of C++ initialization rules have I missed

godbolt.org/z/nGTejaG6T

Screenshot of a Godbolt page, showing that initializing a C++ array works differently from initializing a C array or a C++ vector
#cplusplus#cpp#programming
VegansExploreLive feeds
About