Tag: Contribution
All the articles with the tag "Contribution".
Selecting more than one tag in the sidebar shows only posts that have every selected tag.
- #Contribution#Ethereum#Layer 2
Lineth Postman: A Stuck Claim That Could Never Be Cancelled
Lineth's postman cancels a stuck claim transaction by bumping its stored fees by 10%. Postgres returned those fees as strings, so the bump threw "Cannot mix BigInt and other types" and the cancel never ran. One nonce gap held up every later claim. A two-line fix in the entity mapper.
5 min read - #Contribution#lnd#Lightning Network
LND: Short Reads in NodeAnnouncement2 Address Decoders, Fixed
I reported that LND's NodeAnnouncement2 address decoders accepted truncated records by ignoring how many bytes Read returned. A maintainer confirmed it, found a second bug in the same parser, and fixed both in lnd#11219 with me as a co-author.
4 min read - #Contribution#x402#Python
x402: A skipHandler That Skipped the Payment Too
In x402's TypeScript, Python, and Go servers, a request whose hook returned skipHandler bypassed the before-handler settle. On upfront it returned 200 with no settlement; on escrow it broke capture. A PR that moves the skip after that settle, checked against real escrow programs on forked chains.
5 min read - #Contribution#Python#x402
x402: A V1 Payment Header That Crashed the Python Server
In the x402 Python SDK, the V2-only HTTP resource server passed a decoded V1 payment payload on to requirement matching, which read a field V1 doesn't have and returned 500. A PR that rejects V1 payloads before matching, so the client gets a 402.
3 min read - #Contribution#Python#CI/CD
web3-utils: A Version Gate That Couldn't Read Prereleases
stakefish/web3-utils.py's CI version gate compared versions by keeping only their numeric parts, so beta and rc numbers turned into patch numbers. It rejected valid promotions and let a downgrade through. A PR that switches to packaging.version.
3 min read - #Contribution#Python#Ethereum
web3-utils: An RPC Retry That web3 7 Quietly Broke
In stakefish/web3-utils.py, RPC timeout retries checked for ValueError, but web3 7 raises Web3RPCError. Reproducing it by mocking at the provider, then a review that showed the fix would also retry transaction submission, and the allowlist that followed.
Updated:8 min read - #Contribution#Ethereum#Validator
eth2-monitor: An Epoch Replay That Never Finishes
In stakefish/eth2-monitor, --replay-epoch ran under the same supervisor as live monitoring, so a finished replay was restarted as if it had crashed. A PR that tells completion apart from interruption.
3 min read - #Contribution#CI/CD#GitHub Actions
eth2-monitor: Release Binaries That Overwrite Each Other
stakefish/eth2-monitor's release workflow builds eight OS and architecture combinations into two file names, so only the Windows builds survive. An issue asking which platforms the release is meant to ship.
2 min read - #Contribution#Fuzzing#Gosentry
Reporting a Silent Fuzzer Death in Trail of Bits' gosentry
A gosentry/LibAFL bug where the fuzzer could crash and stop making progress while go test -fuzz still reported success, plus the fix.
2 min read - #Azure#Backup#Recovery
Adding an Azure Recovery Vault Protected Items Check to Prowler
How Prowler identifies Azure Recovery Services Vaults with no protected backup items.
2 min read - #Azure#Backup#Recovery
Adding an Azure Recovery Vault Retention Check to Prowler
How Prowler identifies Recovery Services Vault backup policies with insufficient retention.
2 min read - #Azure#PostgreSQL#Prowler
Adding an Azure PostgreSQL High Availability Check to Prowler
How Prowler identifies Azure Database for PostgreSQL Flexible Servers without enabled high availability.
2 min read - #Azure#PostgreSQL#Prowler
Adding an Azure PostgreSQL Geo-Redundant Backup Check to Prowler
How Prowler verifies that Azure Database for PostgreSQL Flexible Server backups are geo-redundant.
1 min read - #Azure#NetworkSecurity#DDoS
Adding an Azure VNet DDoS Protection Check to Prowler
How Prowler verifies that Azure virtual networks use DDoS Network Protection.
2 min read - #Azure#NetworkSecurity#NSG
Adding an Azure Subnet NSG Check to Prowler
How Prowler detects Azure virtual-network subnets that lack Network Security Group protection.
2 min read - #Azure#MySQL#Prowler
Adding an Azure MySQL High Availability Check to Prowler
How Prowler identifies Azure Database for MySQL Flexible Servers without failover-ready high availability.
2 min read - #Azure#MySQL#Prowler
Adding an Azure MySQL Geo-Redundant Backup Check to Prowler
How Prowler verifies that Azure Database for MySQL Flexible Server backups can survive a regional outage.
2 min read - #Azure#EntraID#Identity
Adding an Azure Entra Recent Sign-In Check to Prowler
How Prowler identifies enabled Microsoft Entra accounts that have not signed in within 90 days.
2 min read - #Azure#EntraID#Identity
Adding an Azure Entra Strong Authentication Check to Prowler
How Prowler verifies that Microsoft Entra tenants enable strong authentication methods and MFA registration enforcement.
2 min read - #Azure#EntraID#Identity
Adding an Azure Entra App Credential Expiry Check to Prowler
How Prowler identifies expired, soon-to-expire, and non-expiring credentials on Microsoft Entra app registrations.
2 min read - #Azure#MicrosoftDefender#Prowler
Adding an Azure Defender CSPM Check to Prowler
How Prowler verifies that Microsoft Defender Cloud Security Posture Management is enabled for an Azure subscription.
2 min read - #Azure#Databricks#Prowler
Adding an Azure Databricks No Public IP Check to Prowler
How Prowler verifies that Azure Databricks classic-compute workspaces use secure cluster connectivity.
2 min read - #Azure#Databricks#Prowler
Adding an Azure Databricks Public Network Access Check to Prowler
How Prowler identifies Azure Databricks workspaces that remain accessible through public network endpoints.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Public Network Access Check to Prowler
How Prowler identifies Cosmos DB accounts that remain reachable through public network endpoints.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Minimum TLS Check to Prowler
How Prowler identifies Cosmos DB accounts that still permit legacy TLS protocols for client connections.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Continuous Backup Check to Prowler
How Prowler identifies Cosmos DB accounts that lack continuous backup and point-in-time restore capability.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Automatic Failover Check to Prowler
How Prowler identifies Cosmos DB accounts that require manual intervention during a regional outage.
2 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Local Accounts Check to Prowler
How Prowler identifies AKS clusters that still allow local Kubernetes accounts to bypass Microsoft Entra ID authentication.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Monitor Check to Prowler
How Prowler identifies AKS clusters without Azure Monitor managed Prometheus metrics enabled.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Defender Check to Prowler
How Prowler identifies AKS clusters without Microsoft Defender for Containers security monitoring enabled.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Auto-Upgrade Check to Prowler
How Prowler identifies AKS clusters without an automatic Kubernetes upgrade channel and helps prevent version drift.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Secret Manager Rotation Check to Prowler
How Prowler verifies that Secret Manager secrets have automatic rotation configured within policy and have not missed their next rotation date.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Secret Manager Public Access Check to Prowler
How Prowler identifies Secret Manager secrets whose IAM policies grant access to everyone or to every Google-authenticated user.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud SQL High Availability Check to Prowler
How Prowler identifies Cloud SQL primary instances that lack regional high availability and automatic zonal failover.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud SQL CMEK Check to Prowler
How Prowler identifies Cloud SQL instances that use Google-managed encryption keys instead of customer-managed keys in Cloud KMS.
4 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud Functions Public Access Check to Prowler
How Prowler detects Cloud Functions that IAM policies make invokable by anyone on the internet or by any Google-authenticated user.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud Functions VPC Check to Prowler
How Prowler's new Cloud Functions VPC connector check helps find missing private-network boundaries in GCP serverless workloads.
3 min read - #Contribution#Supply Chain Security#NIST SP 800-204
Private Registries and Package Mirrors: What I Contributed to the SEAL Security Frameworks
A new SEAL Security Frameworks page on internal package registries - what mirroring defends against, how routing blocks dependency confusion, and why the registry becomes a trust component in its own right.
11 min read - #Contribution#CI/CD Security#Supply Chain Security
Policy as Code Through the CI/CD Pipeline: What I Contributed to the SEAL Security Frameworks
A four-page section on policy as code across the CI/CD pipeline, mapped to NIST SP 800-204D, merged into the SEAL Security Frameworks.
11 min read - #NIST#OSCAL#CNCF
NIST OSCAL and associated projects
An introduction to NIST OSCAL and its associated CNCF projects for compliance as code.
5 min read