這篇文章探討的是資安與 CI/CD 流程整合的一個思路與經驗談。如果今天有辦法將資安掃描與 CI/CD 流程給整合一塊,是否可以讓團隊中的開發人員與資安人員一同合作,減少衝突與吵架,讓團隊產生的程式碼更佳強健與安全。
如同大部分的 CI/CD 概念一樣,每個團隊實做出來的方式都不盡相同,因此作者對於如何將資安整合到 CI/CD 流程中給出了一個範例,透過這個範例讓大家踏入這個領域,接者使用相同思路將其整合到自己團隊的工作流程中。
作者提出了四個階段
Level 1: 安全人員發現資安問題, 開發人員修復問題
Level 2: 安全人員與開發人員合作去產生 test case
Level 3: 當問題修復後,雙方人員繼續合作去尋找系統性的修復並且開發相關的檢測工具
Level 4: 主動的去探討潛在問題,發現並修復
作者使用了一個簡單的範例來展示這四個步驟怎麼進行,該範例就是有個應用程式會於 log 中去輸出敏感的機密資料
Level 1:
安全人員發現 SQLAlchemy 的 debug logging 被打開,然後會將一組機密資訊給輸出。
開發人員透過 ObfuscatedString 的功能去保護該機密資訊欄位,確保其數值不會被輸出
潛在問題:
驗證性不佳: 當開發人員修護後,這個問題要如何被確認是真的修復了。
再次爆發: 如果其他的開發人員不理解這次的修復,意外的將修復給弄壞導致問題再次出現
問題性: 本次的問題是單一問題還是一個全面性設定的問題,是否有其他的機密資訊也一起輸出
Level 2: 自動化測試與驗證
雙方人員合作去產生 Test Case 並且針對這個 Test Case 去撰寫驗證測試,確保修改沒有問題
潛在問題:
透過自動化的測試與驗證,可以確保問題被修復,同時也可以針對未來所有的修改去測試,確保問題不會再次發生。
這時候解決的只有當前這個問題,但是沒有辦法知道說整個團隊系統中是不是也有類似的問題,也有其他的機密資訊被輸出。最差的做法就是遇到問題,就修一次,每遇到一次就修一次
。
Level 3: 探討系統化的問題
下一步驟就是雙方人員合作去尋找系統化的問題並且修復。作者提到一開始先針對單一case修復,接者才要去思考是否有全面性的問題。
這個步驟非常困難,沒有一個絕對的方式去尋找解法,根據不同case會有不同的可能性。
文章全文滿長的,有興趣的人建議閱讀全文,我建議不論是何種職位跟背景的開發人員,基本的資安概念都要有
https://jacobian.org/2021/jan/11/security-ci-cd/
同時也有7部Youtube影片,追蹤數超過0的網紅CarDebuts,也在其Youtube影片中提到,LAS VEGAS — Today the Colorado ZR2 will be competing in its third Best in the Desert’s General Tire Vegas to Reno race. Since the truck made its debut...
「logging level」的推薦目錄:
- 關於logging level 在 矽谷牛的耕田筆記 Facebook 的最讚貼文
- 關於logging level 在 Natasha Juan Facebook 的最佳貼文
- 關於logging level 在 Mickyyy喵 Facebook 的精選貼文
- 關於logging level 在 CarDebuts Youtube 的最佳貼文
- 關於logging level 在 Maser Youtube 的最佳貼文
- 關於logging level 在 神魔之塔 Tower of Saviors Youtube 的最讚貼文
- 關於logging level 在 When to use the different log levels - Stack Overflow 的評價
- 關於logging level 在 Logging Levels - Application Gateway Ingress Controller 的評價
- 關於logging level 在 winstonjs/winston: A logger for just about everything. - GitHub 的評價
logging level 在 Natasha Juan Facebook 的最佳貼文
Edit: Her apology shows that she missed the point of the outrage entirely: https://www.nst.com.my/…/5974…/im-sorry-i-know-youre-hurting
She still thinks that Black Lives Matter is only about personal hurt. 🙄🙄
Samantha Katie James is an embarrassment to our country.
The tone deaf comments and responses to Black Lives Matter shows a lack of understanding of the world at large. "Miss Universe Malaysia"? More like "Miss Privileged Katak Bawah Tempurung".
Malaysia's racism and your racism experience is nowhere near the level that Black people face on a daily basis.
And saying that "we ok only" and pinning the outrage on Netflix is the ultimate mark of your blindness to both global politics and local race politics.
We were never ok.
We were silent. We were complicit.
We are forced into "toleransi" while politicians can openly wave kerises and say Chinese/Indians are "pendatang".
We are forced into "harmoni" while racist Chinese messages spread on social media during Covid-19 lockdown measures telling Chinese to boycott Muslim-owned businesses and only shop at non-halal sections because "Malays are spreading the disease".
We are forced into "multicultural" while our government intrudes into our indigenous peoples' lands and stealing ancestral land for farming and logging (because you're only eligible for bumiputera rights to own land if you're part of the Malay Muslim oligarchy of politically connected families and individuals, apparently).
We are told about how this land is accepting of all races while we mock and spit and curse at refugees like Rohingya and immigrants like Indonesian/Bangladeshi/Nepalese etc. foreign workers, yet at the same time welcome white people as "expatriates".
We say our country is beautiful while too many people here worship Hitler n Nazi Germany, calling it "strong leadership", and indulge in casual anti-Semitism like saying expensive things have "harga Yahudi", and can even make Nazi salutes at graduation ceremonies.
You've failed both at looking at the world and at Malaysia.
Edit to add: Heck why gain so much traction 🤣 anyway a few things:
1) if you #AllLivesMatter at me you'll get blocked/comments deleted. If you wanna know why you can look at this: https://chainsawsuit.com/…/all-houses-matter-the-extended-…/ Black Lives Matter RIGHT NOW, Black Lives under threat RIGHT NOW, this is why an uprising is happening.
2) Muslim and Chinese and Indian and Refugee lives matter but this isn't the point of this post or this hashtag, I can multitask about multiple concerns but this post BLM is the focus, don't out of topic pls
3) It's Pride Month, if you use transphobic insults like "ah gua" and "looks like man" etc you'll get blocked n comments deleted also #CampurLGBT
4) Sorry, I filter my friends lists and who I accept as friends, this is a personal account so I don't simply accept random friends request unless I know you.
5) Wash your hands, wear mask, practice social distancing, look out for each other
6) Change dot Org petitions are useless sorry, please write to your representatives, donate to organisations that need funding, that works better
Links to donate: https://blacklivesmatters.carrd.co/#international
If no money, just play this entire video of music with no adblock, 100% ad revenue goes to BLM funds and organisations: https://youtu.be/bCgLa25fDHM
logging level 在 Mickyyy喵 Facebook 的精選貼文
Wooow 終於!
🎉 Luna Mobile Official Launching 🎉
Dear captains, thank you so much for your support, after days of expecting, Luna Mobile will be officially launched at 11:00AM (GMT+8) 27th December! Super valuable events to celebrate the big day, the adventure of the Luna World has just started, happy gaming!
🎯 Download link 🎯
⚡iOS: http://apple.co/2AitNe7
⚡GPlay: http://bit.ly/2DU245O
⚡Apk: http://bit.ly/2BBeYUH
🔔 New server events 🔔
🎁 Log-in rewards: Logging in continuously every day during the event time to get free rewards
🎁 Free mount give-away: Collect free mount coupons to activate your very first lovely mount, say goodbye to self-walking days
🎁 Grow Up Package: During event time, grow your character, raise the level/battle rate, … and finish the specific missions to receive fabulous gift packages!
🎉 Luna Moblie正式上线! 🎉
亲爱的玩家感谢各位的支持和等待,Luna Moblie即将于11:00 (GMT+8)12月27日正式上线!有各种超值活动等你来,蓝色大陆的大门向你正式开启!
🎯 下载地址 🎯
⚡iOS: http://apple.co/2AitNe7
⚡GPlay: http://bit.ly/2DU245O
⚡Apk: http://bit.ly/2BBeYUH
🔔 游戏内精华开服活动 🔔
🎁 连续七日登入
每日登陆即可领取免费豪礼,除海量提升道具外,2/3/5日还分别额外有金色佣兵/时装/金色装备放送喔!
🎁 咩咩羊免费赠送
软萌可爱的永久稀有金色坐骑咩咩羊,无需付费即可永久获得~
任何角色在创建角色7日内都可通过免费途径收集“咩咩羊兑换券”
集齐100个即可召唤可爱的咩咩到你身边喔!
🎁 迎新盛典
创建角色7日内不断提升自己即可领取海量阶段性奖励~
等级/战力/装备/佣兵......每提升一点都可免费领取奖励。
一步一个台阶,从零开始你的蓝色大陆之旅吧!
#LunaMobile #OfficialLaunching #OBT #MMORPG
logging level 在 CarDebuts Youtube 的最佳貼文
LAS VEGAS — Today the Colorado ZR2 will be competing in its third Best in the Desert’s General Tire Vegas to Reno race. Since the truck made its debut at the 2017 Vegas to Reno, the ZR2 has been piloted by Chad Hall of Hall Racing in 11 Best in the Desert races, logging 3,275 miles in some of the most challenging off-road conditions imaginable.
A total of 434 vehicles have competed in all 11 races in the Best in the Desert series since the ZR2’s race debut. As a testament to the grueling nature of off-road racing, the ZR2 is one of only four vehicles — fewer than 1% of total entrants — that completed each of these 11 competitions.
“Our goal with the Best in the Desert competition is to push the engineering and development of the Colorado platform in the most extreme conditions imaginable,” said Mark Dickens, chief engineer, Government Programs, Performance Variants, Parts and Motorsports. “We’ve already learned things over the past two years that have shaped our off-road portfolio, including the performance parts and motorsports catalog, production vehicles and GM Defense projects.”
Not only has the ZR2 survived the challenges of the Best in the Desert series, but the Chevrolet and Hall Racing teams have found ways to make the truck more robust and efficient since its debut. The truck finished its first 2017 Vegas to Reno in 18 hours and 51 minutes. The following year, the ZR2 improved its finishing time by more than four hours to 14 hours and 34.5 minutes.
The production-based ZR2 is one of the only vehicles that competes in the stock 7300 class. It regularly beats the race times of a wide range of off-road vehicles — everything from dune buggies to modified Ford Raptors, Jeep Wranglers and trophy trucks in the more extreme and well-represented Class 6000 and 6100 classes.
World-renowned off-road racer and engineer Chad Hall received one of the first Colorado ZR2s ever built in May 2017, and he’s been running it ever since. His vehicle began life as a Red Hot Crew Cab ZR2 powered by a 3.6L V-6 engine paired with an eight-speed automatic transmission.
This vehicle was modified with prototype suspension and driveline parts that were developed into 15 factory race components now available to Colorado ZR2 customers. The truck has since been updated with the same production parts available through the Chevy performance catalogue. This portfolio includes race-tuned versions of ZR2’s Multimatic Front and Rear Long Travel DSSV shocks with up to 15 percent more suspension travel in the front and 10 percent in the rear.
Other factory racing parts include a 1.5-inch Body Lift System, Front and Rear Jounce Shock Systems, ZR2 Steel Driveshaft, Plunging Ball Spline Half Shaft System and severe duty Tie Rod Sleeve Systems.
“In off-road racing, your speed comes from your suspension, not your engine. Usually, when you modify the suspension on a stock truck, the rest of the truck can’t keep up with it,” said Chad Hall. “However, the Colorado is such a great platform, everything seems to work at the same level. This is true even during off-road races, which are some of the most punishing miles you’ll ever put on a truck.”
Hall’s race truck was recently upgraded with ZR2 Bison skid plates on its engine, transmission and differential as well as other American Expedition Vehicles Colorado accessories such as Crestone DualSport beadlock wheels and a snorkel for air filtration while racing in dusty climates. For its third year, the ZR2 race truck also receives a new wrap that incorporates the GM Defense logo and additional HID KC HiLiTES to improve nighttime visibility.
![post-title](https://i.ytimg.com/vi/UwsMnapMDMQ/hqdefault.jpg)
logging level 在 神魔之塔 Tower of Saviors Youtube 的最讚貼文
In ancient century, humans built up Enochian Tower, attempting to reach Gods. However, Devils in Hell tried to exploit the Tower to invade Heaven. A bloody war between Gods, Devils and Humans (Three Worlds) broke out, triggering Gods' anger. Gods desperately broke the Tower's top and sealed Devils in it. As time goes by, conflict among Three Worlds continues to disturb the world peace. The last hope lies on the Summoners who can unleash the Seals and wipe out all the Devils!
*Addictive and fun RPG game with match 3 Runestones challenges*
By dissolving Runestones, attacks will be fired off towards the enemies. Attaining a higher number of Combos will power up the attack.
*Legends come together to overturn the end of the world
Fight with mythical characters from Greece, Egypt, China to go through the experience of a legendary Summoner!
*Experience the brand new RPG style
Level up and Evolve Monsters to form the strongest Team to fight with you.
*Logging in everyday will reward you with Diamonds to summon Rare Monsters!
![post-title](https://i.ytimg.com/vi/gbq4OL9Ggzk/hqdefault.jpg)
logging level 在 Logging Levels - Application Gateway Ingress Controller 的推薦與評價
Level 1 is the default one and it shows minimal number of log lines. Level 5, on the other hand, would display all logs, including sanitized contents of config ... ... <看更多>
logging level 在 winstonjs/winston: A logger for just about everything. - GitHub 的推薦與評價
The levels provided to createLogger will be defined as convenience methods on the logger returned. // // Logging // logger.log({ level ... ... <看更多>
logging level 在 When to use the different log levels - Stack Overflow 的推薦與評價
... <看更多>
相關內容