I write bugs. @obliquesecurity, prev @google, @coreos he/him
Berkeley, CA
- Tweets 841
- Following 157
- Followers 1,329
- Likes 1,431
Pinned Tweet
New blog post!
Turns out Cloud Shell now ships with a vTPM. I wrote a runnable guide using #golang for attesting device keys with a Trusted Platform Module.
Come join the journey of trying to make sense of hundred-page PDF specs.
ericchiang.github.io/post/tp…
1
4
14
What if we took Claude Opus without guardrails and pointed it at one of the most brittle auth protocols in existence? You'll never guess the results
oblique.security/blog/hackin…
4
11
968
Eric Chiang retweeted
Hackers reportedly used something called "TruffleHog" during their attack. They also used "child_process", and something called HTTP, something called TLS, and something called TCP.
Please be on the lookout for any of these hacking tools being used in your environment.
56
55
838
48,806
Eric Chiang retweeted
What I've been up to the last few months: working on the untrendy but important problem of authorization in corporate environments. Check it out!
Identity management has quietly become the primary security perimeter. It's a mess. Identity requires constant manual work that security teams burn out from.
At Oblique, we're helping organizations make their access controls actually maintainable:
oblique.security/blog/identi…
5
15
2,464
Confidential Compute always seems like a breakthrough security technology for a threat model basically no one has. Now that GPUs are embracing it, will it finally find a use with AI?
ericchiang.github.io/post/co…
2
177
Eric Chiang retweeted
Rather than a security tool alerting the security team (in Slack), who then needs to find the right person to ping (also in Slack) — what if the tool just short circuited that and went right to the source (in Slack, of course)?
mayakaczorowski.com/blogs/sl…
1
3
17
2,010
Eric Chiang retweeted
Google created the Advanced Protection Program to help high-risk individuals keep their accounts secure. The program is great (I’ve used it for years!), it’s just a shame the company rarely mentions it. glitchcat.xyz/p/googles-adva…
9
92
321
48,003
Eric Chiang retweeted
This nice library allows PKCS#11 over RPC calls to be served over a socket.
github.com/google/go-p11-kit
I imported it in GoKey and modified its SSH server to accept SSH forwarding of that interface.
Works like a charm.
github.com/usbarmory/GoKey?t…
1
4
14
3,280
Eric Chiang retweeted
🚀 The day has arrived! We are thrilled to announce the general availability of our continuous profiling cloud product. Welcome to a new era of observability!
Learn about the details in our announcement blog post.
polarsignals.com/blog/posts/…
11
44
157
86,485
BSidesSF talks are up!
"You can't work harder to keep up with scale. You can't hire fast enough to keep up with scale. If you try to be a hero, you will burn out." - @__weeks__
piped.video/watch?v=c3B-ig_1…
2
296
I'll be speaking at @BSidesSF next Saturday with @__weeks__. If you're coming (or in town for RSA) hit me up!
sched.co/1JrCm
2
2
9
672
Eric Chiang retweeted
OH:" this is the way we show wealth in the Bay Area"
*Shows a $500 Garmin watch*
1
1
6
1,875
Oh hey, Tailscale now supports OpenID Connect to federate identity
Excited to see how many bug reports start with "I know this is a MUST NOT in the spec, but..."
Congrats @Twitchyliquid64 on the launch!
tailscale.com/blog/custom-oi…
3
3
395
Fun fact! Did you know that JWT alg "none" isn't explicitly disallowed by the OpenID Connect spec?
github.com/coreos/go-oidc/is…
Or that JWTs can be issued for multiple OAuth2 client_ids (and be an array rather than a string)?
openid.net/specs/openid-conn…
2
2
253
Eric Chiang retweeted
Excited to present new(?) approach to #fuzzing where one doesn't need to write fuzz functions.
Wanna fuzz all binaries on github - no problem.
Just give the fuzzer binaries to test. No false positives & 100% fidelity.
Blender: whole-program fuzzing:
github.com/dvyukov/centipede…
7
65
214
36,359
I wrote a Go library for gRPC HTTP annotations without a proxy!
Define your REST bindings
rpc GetItem(GetItemRequest) returns(Item) {
option (google.api.http) = {
get: "/v1/items/{name=*}"
};
}
And it spits out a http.Handler :)
github.com/ericchiang/grpc-h…
1
4
271
Also, did you know Google's API guidelines for using these annotations are public? google.aip.dev/
This is a great resource that address things like APIs that play well with configuration-as-code, or translate well to a database layer
2
109
Eric Chiang retweeted
debugging strategy: do the annoying thing
ALT do the annoying thing person (thinking): "I should really add an automated test for this, but it'll take a long time... nah, I'll be finished in 5 minutes anyway!" But as I become more and more desperate, eventually I'll give in and do the annoying thing. Often it helps! person (thinking): "FINE, I'll add the stupid test"
11
89
486
.@Tailscale's amazing. Local git daemon on one machine, git clone git://[addr]/[path] on another. Took more time to figure out the git daemon flags than set up Tailscale
And apparently I already have a Personal Pro account?
1
17