Staff Security Engineer, Red Team @GitLab, GCPN, GWAPT, Experienced InfoSec Newb, Coder, CrossFitter, Musician, Internal combustion chamber enthusiast.
Atlanta, GA
Joined July 2015
- Tweets28
- Following596
- Followers186
- Likes619
Defending your software supply chain is hard. Forming realistic attack scenarios to test your orgs detection/response capabilities? Also hard. Here’s an approach we tried that improved our readiness. Hope it helps you too. gitlab.com/gitlab-com/gl-sec…
Experimenting, listening to what others do to solve the same problem in different situations is helpful. I suppose part of the issue is prioritizing and establishing new habits. Easier said than done, but the essence of getting where you want to go.
The goal itself is impact? 🤔And , right, strategy part is what I’m wanting to iterate on a bit from a personal standpoint. This may not even be a nrml thing people do individually on a day to day basis, but that’s never stopped me before. 😆 A change is needed.
Setting goals is easy. Finding effective strategies to meet those goals proves hard for me. I’ve started writing down goals, but also specific strategies in tandem. “I will do x for y hours on day z.” I also track if I do it or not. What strategies work best for you?
One of my favorite albums end-to-end in along time. Had it on repeat for a straight week since it dropped. It’s so good.
I had a good laugh that these two tweets just happened to show up right next to each other in my timeline @hellNbak_ 😅
untamper-my-lockfile: gitlab.com/gitlab-org/fronte…
bump-key: gitlab.com/gitlab-com/gl-sec…
Very excited and proud to present this collaborative work with @dennisappelt tomorrow @BlackHatEvents! You can leverage our tooling in your own orgs/projects to better protect your software supply chain with untamper-my-lockfile, and demo adversarial impact with bump-key!
This Post is from an account that no longer exists. Learn more
codeEmitter retweeted
"Learn not to add too many features right away, and get the core idea built and tested." - Leah Culver
codeEmitter retweeted
@code_emitter present both an offensive & defensive perspective of an attack technique that hides malicious code in open source contributions & that reduce the likelihood of the mods being caught during review. Learn more about this #BHEU Briefing>> blackhat.com/eu-21/briefings…
codeEmitter retweeted
I recently had a look at @gitpod and found two really nice bugs:
about.gitlab.com/blog/2021/0…
codeEmitter retweeted
From my perspective, the greatest benefit of story mapping is not the map. It is the discussions, discovery, and alignment that result from the process of creating a map.
#agile
codeEmitter retweeted
If the thing that stands
between you and a better answer
is rules,
break the rules.
#leadership
codeEmitter retweeted
No one that knew Dan Kaminsky well is talking about DNS today. They are talking about kindness, boundless energy and positivity, spontaneous adventures, and how hard he worked to lift others up. Want to emulate one of the greatest hackers of all time? Let that be your guide.
Me: I’m language agnostic! Seems like a good idea to write this CLI in NodeJS because JSON and Node dependency evaluation!
Also me: Let’s talk about JavaScript for infosec tools. No really. Let’s take a good hard look at JavaScript.