NetworkingNexus.net

New Vulnerability Exposes Kubernetes to Man-in-the-Middle Attacks: Here’s How to Mitigate

What is CVE-2020-8554?

A few weeks ago a solution engineer discovered a critical flaw in Kubernetes architecture and design, and announced that a “security issue was discovered with Kubernetes affecting multi-tenant clusters. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster.” If a hostile user can create a ClusterIP service and set the spec.externalIP field, they can intercept traffic to that IP. In addition, if a user can patch the status of a LoadBalancer service, which is a privileged operation, they can also intercept traffic by exploiting the vulnerability.

Who is Affected?

All Kubernetes versions including the latest release v1.20 are vulnerable to this attack, with the most significant impact being to multi-tenant clusters. Multi-tenant clusters that grant tenants the ability to create and update services and pods are most vulnerable. Since this is a major design flaw with no fix in sight, it becomes imperative to understand and mitigate this CVE.

Technical Overview

The man-in-the-middle (MITM) attack starts with step 1 (shown in the diagram, below). A workload sends a connection request to legitimate IP 4.4. Continue reading

Edge Cloud and 5G Poised to Impact Next Era of Networking

The edge cloud will not only become the new point of service delivery and experience but also the point of innovation and monetization.

Rails 6 Database Record Pagination with Kaminari

How to paginate records on your Rails 6 application data.

Who's Hiring?

Looking to rapidly hire Top Software Developers? Get Started with Toptal. Toptal will match you with top-quality, pre-screened freelance software developers that meet your project requirements. All in under 48 hours. Get started right away with a no risk trial.

InterviewCamp.io has hours of system design content. They also do live system design discussions every week. They break down interview prep into fundamental building blocks. Try out their platform.

Triplebyte lets exceptional software engineers skip screening steps at hundreds of top tech companies like Apple, Dropbox, Mixpanel, and Instacart. Make your job search O(1), not O(n). Apply here.

Need excellent people? Advertise your job here!

Cool Products and Services

IP2Location is IP address geolocation service provider since 2002. The geolocation database or API detects location, proxy and other >20 parameters. The technology has been cited in more than 700 research papers and trusted by many Fortune 500 companies. Try it today!

ipdata is a reliable IP Address Geolocation API that allows you to lookup the approximate location of any IP Address, detect proxies and identify a company from an IP Address. Trusted by 10,000+ developers. Try it now!

Developers care Continue reading

Tips on How to Focus While Working from Home

No matter where you work, distractions must be available. Even in your office, there would be nearby gossip and people chatting about which can affect your focus. Working from home has its challenges with its discipline and structure.

You might need to work from home as a result of this pandemic. You could have young ones at home with you too. These kids do not respect the fact that you might have some very important work to handle. This is why this article will show you some tips and tricks on how to focus better as you work from home. Stick with us.

How to Stay Focused as you Work from Home

Know yourself

We all know how we are, our tempo, and what flows for us. At times some of us like waking up early, some of us like sleeping till it’s noon. No matter what you prefer, you need to take some time to know when you’ll be at your best. You need to know the time of day when you’ll be extremely productive and you can organize your schedule to handle difficult tasks during those productive times. Remember, prioritizing your tasks is a great key to Continue reading

Risus sed vulputate odio ut enim blandit eiu tempor incididunt

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat […]

The post Risus sed vulputate odio ut enim blandit eiu tempor incididunt appeared first on Noction.

Adipiscing vitae proin sagittis nisl rhoncus mattis

The post Adipiscing vitae proin sagittis nisl rhoncus mattis appeared first on Noction.

Dictum fusce ut placerat orci nulla pellentesque

The post Dictum fusce ut placerat orci nulla pellentesque appeared first on Noction.

volutpat commodo sed egestas egestas fringilla phasellus

The post volutpat commodo sed egestas egestas fringilla phasellus appeared first on Noction.

Id neque aliquam vestibulum morbi blandit cursus

The post Id neque aliquam vestibulum morbi blandit cursus appeared first on Noction.

Laoreet sit amet cursus sit amet dictum

The post Laoreet sit amet cursus sit amet dictum appeared first on Noction.

Nulla facilisi etiam dignissim diam quis enim

The post Nulla facilisi etiam dignissim diam quis enim appeared first on Noction.

Mauris pharetra et ultrices neque ornare aenean

The post Mauris pharetra et ultrices neque ornare aenean appeared first on Noction.

Neque egestas congue quisque egestas diam in

The post Neque egestas congue quisque egestas diam in appeared first on Noction.

Aliquam purus sit amet luctus venenatis lectus

The post Aliquam purus sit amet luctus venenatis lectus appeared first on Noction.

Vitae tempus quam pellentesque nec nam aliquam

The post Vitae tempus quam pellentesque nec nam aliquam appeared first on Noction.

Closing Out 2020 with More Innovation for Developers

Recently our CEO Scott Johnston took a look back on all that Docker had achieved one year after selling the Enterprise business to Mirantis and refocusing solely on developers. We made significant investments to deliver value-enhancing features for developers, completed strategic collaborations with key ecosystem partners and doubled down on engaging its user community, resulting in a 70% year-over-year increase in Docker usage.

Even though we are winding down the calendar year, you wouldn’t know it based on the pace at which our engineering and product teams have been cranking out new features and tools for cloud-native development. In this post, I’ll add some context around all the goodness that we’ve released recently.

Recall that our strategy is to deliver simplicity, velocity and choice for dev teams going from code to cloud with Docker’s collaborative application development platform. Our latest releases, including Docker Desktop 3.0 and Docker Engine 20.10, accelerate the build, share, and run process for developers and teams.

Higher Velocity Docker Desktop Releases

With the release of Docker Desktop 3.0.0, we are totally changing the way we distribute Docker Desktop to developers. These changes allow for smaller, faster Docker Desktop Continue reading

Cloudflare Acquires Linc

Cloudflare has always been about democratizing the Internet. For us, that means bringing the most powerful tools used by the largest of enterprises to the smallest development shops. Sometimes that looks like putting our global network to work defending against large-scale attacks. Other times it looks like giving Internet users simple and reliable privacy services like 1.1.1.1. Last week, it looked like Cloudflare Pages — a fast, secure and free way to build and host your JAMstack sites.

We see a huge opportunity with Cloudflare Pages. It goes beyond making it as easy as possible to deploy static sites, and extending that same ease of use to building full dynamic applications. By creating a seamless integration between Pages and Cloudflare Workers, we will be able to host the frontend and backend together, at the edge of the Internet and close to your users. The Linc team is joining Cloudflare to help us do just that.

Today, we’re excited to announce the acquisition of Linc, an automation platform to help front-end developers collaborate and build powerful applications. Linc has done amazing work with Frontend Application Bundles (FABs), making dynamic backends more accessible to frontend developers. Their Continue reading

Beat – An Acoustics Inspired DDoS Attack

On the week of Black Friday, Cloudflare automatically detected and mitigated a unique ACK DDoS attack, which we’ve codenamed “Beat”, that targeted a Magic Transit customer. Usually, when attacks make headlines, it’s because of their size. However, in this case, it’s not the size that is unique but the method that appears to have been borrowed from the world of acoustics.

Acoustic inspired attack

As can be seen in the graph below, the attack’s packet rate follows a wave-shaped pattern for over 8 hours. It seems as though the attacker was inspired by an acoustics concept called beat. In acoustics, a beat is a term that is used to describe an interference of two different wave frequencies. It is the superposition of the two waves. When the two waves are nearly 180 degrees out of phase, they create the beating phenomenon. When the two waves merge they amplify the sound and when they are out of sync they cancel one another, creating the beating effect.

Acedemo.org has a nice tool where you can create your own beat wave. As you can see in the screenshot below, the two waves in blue and red are out Continue reading

Scaling the World’s Largest CDNs – Matthew Walster, Network Reliability Engineer

Matthew shares his experiences buildings some of the largest CDNs on the planet. We talk about serving hundreds of thousands of streams, the impact of 4k video, CDN nodes deeply embedded in the service provider network, downsides of multicast, DRM and protocols.

« Previous 1 … 840 841 842 843 844 … 3,859 Next »