I write bugs. @obliquesecurity, prev @google, @coreos he/him
Berkeley, CA
Joined November 2009
- Tweets841
- Following157
- Followers1.3K
- Likes1.4K
Pinned Tweet
New blog post!
Turns out Cloud Shell now ships with a vTPM. I wrote a runnable guide using #golang for attesting device keys with a Trusted Platform Module.
Come join the journey of trying to make sense of hundred-page PDF specs.
ericchiang.github.io/post/tp…
What if we took Claude Opus without guardrails and pointed it at one of the most brittle auth protocols in existence? You'll never guess the results
oblique.security/blog/hackin…
Eric Chiang retweeted
Hackers reportedly used something called "TruffleHog" during their attack. They also used "child_process", and something called HTTP, something called TLS, and something called TCP.
Please be on the lookout for any of these hacking tools being used in your environment.
Eric Chiang retweeted
What I've been up to the last few months: working on the untrendy but important problem of authorization in corporate environments. Check it out!
Identity management has quietly become the primary security perimeter. It's a mess. Identity requires constant manual work that security teams burn out from.
At Oblique, we're helping organizations make their access controls actually maintainable:
oblique.security/blog/identi…
Confidential Compute always seems like a breakthrough security technology for a threat model basically no one has. Now that GPUs are embracing it, will it finally find a use with AI?
ericchiang.github.io/post/co…
Eric Chiang retweeted
Rather than a security tool alerting the security team (in Slack), who then needs to find the right person to ping (also in Slack) — what if the tool just short circuited that and went right to the source (in Slack, of course)?
mayakaczorowski.com/blogs/sl…
Eric Chiang retweeted
Google created the Advanced Protection Program to help high-risk individuals keep their accounts secure. The program is great (I’ve used it for years!), it’s just a shame the company rarely mentions it. glitchcat.xyz/p/googles-adva…
Eric Chiang retweeted
This nice library allows PKCS#11 over RPC calls to be served over a socket.
github.com/google/go-p11-kit
I imported it in GoKey and modified its SSH server to accept SSH forwarding of that interface.
Works like a charm.
github.com/usbarmory/GoKey?t…
Eric Chiang retweeted
🚀 The day has arrived! We are thrilled to announce the general availability of our continuous profiling cloud product. Welcome to a new era of observability!
Learn about the details in our announcement blog post.
polarsignals.com/blog/posts/…
BSidesSF talks are up!
"You can't work harder to keep up with scale. You can't hire fast enough to keep up with scale. If you try to be a hero, you will burn out." - @__weeks__
youtube.com/watch?v=c3B-ig_1…
I'll be speaking at @BSidesSF next Saturday with @__weeks__. If you're coming (or in town for RSA) hit me up!
sched.co/1JrCm
Eric Chiang retweeted
OH:" this is the way we show wealth in the Bay Area"
*Shows a $500 Garmin watch*
Oh hey, Tailscale now supports OpenID Connect to federate identity
Excited to see how many bug reports start with "I know this is a MUST NOT in the spec, but..."
Congrats @Twitchyliquid64 on the launch!
tailscale.com/blog/custom-oi…
Fun fact! Did you know that JWT alg "none" isn't explicitly disallowed by the OpenID Connect spec?
github.com/coreos/go-oidc/is…
Or that JWTs can be issued for multiple OAuth2 client_ids (and be an array rather than a string)?
openid.net/specs/openid-conn…
Eric Chiang retweeted
Excited to present new(?) approach to #fuzzing where one doesn't need to write fuzz functions.
Wanna fuzz all binaries on github - no problem.
Just give the fuzzer binaries to test. No false positives & 100% fidelity.
Blender: whole-program fuzzing:
github.com/dvyukov/centipede…
I wrote a Go library for gRPC HTTP annotations without a proxy!
Define your REST bindings
rpc GetItem(GetItemRequest) returns(Item) {
option (google.api.http) = {
get: "/v1/items/{name=*}"
};
}
And it spits out a http.Handler :)
github.com/ericchiang/grpc-h…
Also, did you know Google's API guidelines for using these annotations are public? google.aip.dev/
This is a great resource that address things like APIs that play well with configuration-as-code, or translate well to a database layer
Eric Chiang retweeted
debugging strategy: do the annoying thing
ALT do the annoying thing person (thinking): "I should really add an automated test for this, but it'll take a long time... nah, I'll be finished in 5 minutes anyway!" But as I become more and more desperate, eventually I'll give in and do the annoying thing. Often it helps! person (thinking): "FINE, I'll add the stupid test"
.@Tailscale's amazing. Local git daemon on one machine, git clone git://[addr]/[path] on another. Took more time to figure out the git daemon flags than set up Tailscale
And apparently I already have a Personal Pro account?
