Private Network Access: introducing preflights - Chrome Developers

Chrome is deprecating direct access to private network endpoints from public websites as part of the Private Network Access (PNA) specification. Chrome will start sending a CORS preflight request ahead of any private network request for a subresource, which asks for explicit permission from the target server.

GitHub - WICG/private-network-access

Contribute to WICG/private-network-access development by creating an account on GitHub.

Chrome Platform Status

Sends a CORS preflight request ahead of any private network requests for subresources, asking for explicit permission from the target server. A private network request is any request from a public website to a private IP address or localhost, or from a private website (e.g. intranet) to localhost.

Amazon GuardDuty now detects EC2 instance credentials used from another AWS account

Posted On: If you are an existing Amazon GuardDuty customer then you don't need to take any action to start using this new threat detection capability to monitor your control plane operations as captured in AWS CloudTrail.

AWS Trusted Advisor now integrates with AWS Security Hub

Posted On: Trusted Advisor provides recommendations that help you follow AWS best practices. Trusted Advisor uses checks to evaluate your account, which identify ways to optimize your AWS infrastructure, improve security and performance, reduce costs, and monitor service quotas.

Reducing Security Risks in Open Source Software at Scale: Scorecards Launches V4 - Open Source Security Foundation

Authors: Best Practices Working Group, Laurent Simon (Google), Azeem Shaikh (Google), and Jose Palafox (GitHub) Today, two members of the Open Source Security Foundation, Google and GitHub, are partnering to release Scorecards V4, featuring a new GitHub Action, an added security check, and scaled up scans of the open source ecosystem.

Reducing Security Risks in Open Source Software at Scale: Scorecards Launches V4

Since our July announcement of Scorecards V2, the Scorecards project-an automated security tool to flag risky supply chain practices in open source projects-has grown steadily to over 40 unique contributors and 18 implemented security checks. Today we are proud to announce the V4 release of Scorecards, with larger scaling, a new security check, and a new Scorecards GitHub Action for easier security automation.

Securing Admission Controllers

Author: Rory McCune (Aqua Security) Admission control is a key part of Kubernetes security, alongside authentication and authorization. Webhook admission controllers are extensively used to help improve the security of Kubernetes clusters in a variety of ways including restricting the privileges of workloads and ensuring that images deployed to the cluster meet organization's security requirements.

feat: Sigstore verification of policies on download by viccuad · Pull Request #135 · kubewarden/policy-server

Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes.

Recent improvements on apt.llvm.org

Hello Time for an update about recent improvements and changes on https://apt.llvm.org Arm64 apt.llvm.org is now generating arm64 for all Debian & Ubuntu supported versions. Thanks to Leandro Nunes & Kristof Beyls from ARM for the help and support. Packages are built on two servers with 80 CPU and 256G of RAM.

Introduction

by Sangkeon Lee (sangkenlee@gmail.com) This book illustrates how to learn and apply the OPA(Open Policy Agent) for software/service development. And this book is an English translation of my book about OPA published in South Korea at the end of July 2021.

OPA/Rego入門

情報セキュリティの分野で注目されている汎用的なポリシーエンジンOPAと、OPAで利用するポリシー記述言語Regoについて解説します

Build you a Google Groups

NOTE: This post is a companion to the video below. The video is in the form of an exploratory discussion. This post just talks about the resulting artifact. Google Groups is a mailing list discussion service that Google launched back in 2001.

アーキテクチャが複雑化しているからこそ、Webセキュリティの基礎を学ぶ必要があった。Railsへの理解も深まったと評価 | KENRO

2010年に設立されたウォンテッドリー株式会社は「シゴトでココロオドルひとをふやす」をミッションに、個人ユーザー数330万人、登録会社数42,000社を突破したビジネスSNS「Wantedly」を運営しており、2017年に東京証券取引所マザーズに上場しました。 個人向けには気軽に会社訪問ができる「Wantedly Visit」、名刺管理もでき、出会いを記録し、活躍を共有する「Wantedly

フィンテックは高いレベルのセキュリティが求められるので、開発の上流工程から脆弱性の芽を摘みたかった | KENRO

2006年に設立された株式会社インフキュリオンは、「テクノロジーの力で、社会に新しい価値と利便性を生み出す。」をビジョンに、金融と決済を中心に、「BaaS（Banking as a Service）プラットフォーム事業」や「共創型コンサルティング事業」、「加盟店向けソリューション事業」を展開しています。 ...

KENRO (ケンロー) | セキュアコーディングを当たり前にするエンジニアの学習プラットフォーム

KENRO (ケンロー) は、Web 開発に必要なセキュリティ技術のハンズオンの研修・学習を行うことができる、環境構築不要のクラウド型学習プラットフォームです。

Introducing PinataHub: Explore the world of leaked secrets in GitHub.

In our first article, we will walk you through the just-released PinataHub platform, the largest archive of leaked credentials and secrets in public GitHub repositories. Forgetting secrets in the source code is a very common problem in the DevOps world, which can have disastrous consequences for any organization.

https://portswigger.net/polls/top-10-web-hacking-techniques-2021

Bringing human-centric security to everyone | 1Password

As our online lives become subject to new and evolving threats, we're doubling down on protecting the digital privacy and peace of mind of everyday people - at home and at work. I'm delighted to announce that 1Password has raised $620 million in our latest investment round that values our company at $6.8 billion.