allset_

You do not need to use Bitbucket, works with Github too.

It's also a significant step in a direction to where every dependency that these software publishers is also signed, increasing the overall confidence that there's no malicious code in the software they publish.

Also, in future implementations it would be possible for security conscious publishers to attach cryptographic attestations produced by trusted third party hardware manufacturers to their signature demonstrating the private key was generated on the hardware device and therefore could not be under the control of the service operators. Security conscious clients could start to require this for dependencies they pull in.

You have to be in person for that attack, which is a much higher cost than taking over someone's account remotely from a different country. It's also a much higher risk of getting caught and going to jail.

Other management tasks are easier when you have separate clusters, such as applying environment-specific OPA policies and not having to filter them based on labels or annotations you hope everyone is using correctly.

Almost all of the ransomware gangs now also exfil data and use that as additional leverage.

Most attack campaigns start with compromised credentials, so MFA absolutely helps prevent ransomware.

In Seattle (a couple years ago at this point) the highest lease break fee I saw was 1/2 month which already seemed quite high to me. 1.5x seems crazy.

Except 99% of people wont accept month to month due to the instability.

It's a layer you need regardless, it's not unique to Kubernetes.

Agreed. Long(er) lived refresh tokens, and then having signed access tokens such as JWTs so that the API server doesn't have to hit the database on every request.

It seems publishing to https://sigstore.dev/ and having your update agent use that would be a solid starting point for smaller developers.

You do need a fairly recent version of OpenSSH though.

It's not specifically a React thing, but JavaScript enables it. Lazy-loading content is a good idea if you're building dynamic web _applications_, as common components (buttons, modals, etc.) don't need to be reloaded over and over. However, with mostly static content like a blog, it's generally not a great idea.

I don't like Jira that much, but this is just blatantly false.

> A cache-less refresh for me on a blazing fast dev machine takes between 3-10 minutes on a normal day, though it might only take 1m if the internet gods are feeling particularly merciful

I use Jira daily, it's nowhere near this bad. It's not fast, but pages load in about 5 seconds.

> changing ticket status can't be done without opening separate pages

You select the new state from the drop-down and set it. This is available through a few different routes/views.

> good luck finding it later

Their search looks through title and description, what else do you want?

> Backlogs inevitably evolve into infinite swamps that no one knows the full contents of.

If you let them, of course. If you don't close the tickets, what did you expect to happen?

Seems like the ideal use case for a hardware-backed token to be issued to each citizen to hold a private key and use MFA (PIN) to unlock that.

It's true in the US. If someone manages to steal your debit card data and your PIN, all the banks say "well your PIN was used, so it must have been you" and you're SOL.

What horrible carrier is that? Even in the US which has high cellular data costs it's usually $10/GB

USB mass storage based authentication also does not protect against malware stealing the keys. A YubiKey (or similar token) performs all of the cryptographic operations in a separate environment that malware cannot access.

Agreed. Having your lowest tier offering priced at over $500/mo is cost prohibitive in a lot of situations. Even their "dev" tier is $130/mo for a single instance. It would be much nicer if they just let you choose how much storage, CPU, and memory you need rather than only letting you select from a limited set of offerings.

My S8 just received a security update a couple weeks ago, which puts it at over 3 years of updates. It's stuck on Android 9 though.

This has gotten _a lot_ better since Google started contractually requiring OEMs to provide regular updates. My Galaxy S8, purchased through a carrier, is still receiving security updates (although probably not for much longer).

I just looked to price one on their website, and it starts with some absurdly low specs including a 128GB SSD and a horrible 1366x768 TN screen for $1140. This is not acceptable in 2020.

Any info about what domain is being visited would be client side, which could be easily changed.

Google Meets has this as well, don't Zoom and others?

It's odd they don't list OPA Gatekeeper, which is probably the best tool for enforcing security and other best practices in Kubernetes clusters.

List of CNCF open source security projects without the blog post: https://landscape.cncf.io/category=security-compliance&forma...

I believe this is the right way to think about it. You can start off with a relatively monolithic architecture, and then break that out into smaller microservices as needed with a much easier transition.

This is the work from home day each week.

>or to make sure you're getting work that doesn't touch on the right metrics.

What? The metrics should be distilled from the overall company/org/team goals and mission and if you're working on things that don't align with those of course you're not going to have a good performance review.

XPS 13 Developer edition meets these requirements. The touch pad isn't as good as a MacBook (none are) but it's plenty sufficient for working when not at a desk and if you do Docker based development having a Linux OS is actually much more performant.