https://tailscale.com/blog/how-nat-traversal-works
A delightful and thorough explanation of NAT traversal.
/ht @Cirio
šØš¦
Daniel Davidson
@tacky1@defcon.social
- 1 Followers
- 41 Following
- 55 Posts
Infrastructure security champion. Zero trust evangelist. Threat modelling leader.
šØš¦
šØš¦
āThe entire enterprise private network is not considered an implicit trust zone.ā
If your VPN rules include, āfrom trust to trustā, itās not #ZeroTrust.
I had my first #freelance client call yesterday. A solid first performanceā¦ except for the part where I referred to the NIST Cybersecurity Framework as the NIST Cloud something something. Fortunately, the client wasnāt fussed about it. š
Funniest thing I heard today thatās actually a good idea: āthis docuemnt should be pinned to every channel in slack and considered required readingā When I shared a link to our Data Taxonomy Management System (DTMS).
@paulsanders Iām installing Claude Code right now to hopefully accelerate some open source code contributions Iād like to make. Still hoping Iāll find a more impactful use case.
I'm pretty stoked on https://github.com/mrwadams/stride-gpt for helping folks produce STRIDE-based threat models. I was pleasantly surprised by the threats identified by pointing it at some public GitHub repos. Looking forwarding to trying it at work this week
GitHub - mrwadams/stride-gpt: An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.
An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology. - mrwadams/stride-gpt
#FounderMode vs leading from behind. Looking back at this last project, implementing preliminary ZTNA: we got there in the end, but in almost none of the ways I intended for it be implementedā¦ I havenāt decided yet if I should have been more hands on and prescriptive, or if I gave folks the appropriate level of autonomy and the process worked as intended. In any case, more #ZeroTrust and less VPN is better.
@paulsanders Iām keen to get into freelance and consulting. Iāll check out this recommendation. And if thereās any other books or resources that helped you start Yobah, Iād love to hear them.
@theomegabit Iād much rather pay for the product than be the product. And I feel like Internet search has definitely been a missing piece for me. Iām keen to hear your longer term evaluation of Kagi and what, if anything, itās missing.
Unfortunately my first reaction was, of course Microsoft is vulnerable to an ATO schemeā¦ but in theory any provider that supports device code flow is vulnerable. Itās not an OAuth 2 problem, itās a phishing problem.
This attack method emphasizes the importance of device verification and authorization. An untrusted device shouldnāt be permitted to participate in the device code flow.
