K
Kelly Shortridge
swagitda.com · Personal blog · on HN since 2019
Kelly Shortridge writes about security strategy, DevOps and security, and tools like Deciduous for building security decision trees.
What HN saysHN links it for her SecObs post and the Deciduous tool, and she responds to feedback there.
16HN people shared it
2linked it in comments
19stories submitted
287story points
4 years agolast shared
2019people per year2026
Most-shared posts
- 1The Security Obstructionism (SecObs) Market3 people · 5 points · first shared 2022 · discussion on HN
- 2On YOLOsec and FOMOsec2 people · 72 points · first shared 2020 · 11 comments on HN
- 3Securing the Supply Chain of Nothing2 people · 49 points · first shared 2022 · 24 comments on HN
- 4Show HN: Deciduous – A security decision tree generator and editor2 people · 8 points · first shared 2021 · 1 comments on HN
- 5Creating Security Decision Trees with Graphviz2 people · 5 points · first shared 2021 · discussion on HN
- 6Controlled Chaos: The Inevitable Marriage of DevOps and Security [pdf]2 people · 1 points · first shared 2019 · discussion on HN
- 7Rick and Morty’s Thanksploitation Deciduous Decision Tree1 people · 96 points · first shared 2021 · 15 comments on HN
- 8Deciduous: A Security Decision Tree Generator1 people · 39 points · first shared 2021 · 1 comments on HN
- 9Markets DGAF About Cybersecurity1 people · 5 points · first shared 2021 · 1 comments on HN
- 10IBM and Red Hat: Bamboozles, Foozles, and the Hybrid Cloud Chimera1 people · 2 points · first shared 2020 · discussion on HN
- 11Ransomware: Towards an Economic Equilibrium1 people · 2 points · first shared 2019 · discussion on HN
- 12Shall We Play a Coordination Game?1 people · 1 points · first shared 2020 · discussion on HN
- 13Resilience in Security 1011 people · 1 points · first shared 2020 · discussion on HN
- 14Hierarchy of Security Product Needs and Vendor Selection v1.0 [Satire]1 people · 1 points · first shared 2020 · discussion on HN
What HN people wrote when they linked it
andrewrynhard · 2019-09-26
First of all, thank you for taking the time to write this out.
The feedback is very valuable.
I will do my best to address each comment.
Let me start by laying out our design constraints.
We knew we wanted a handful of simple features:
- minimal
- immutable
- and secure
and we approached them with the willingness to do whatever it took to achieve them, no matter how different it would be from any Linux distribution today.
The degree to which we want to obtain minimalism is what I like to call "ultra".
Not a single file should be on the image that isn't absolutely needed.
Furthermore, not a single process should be allowed to run that isn't required to obtain the goal of running Kubernetes.
So we started by creating an image with just enough to run the kubelet and the kubelet only.
Obviously, this isn't practical, but it was a place to start.
In implementing our immutability design constraint we decided to:
- make the root filesystem read-only
- have no package manager
- not allow any generic use of the OS (i.e. it would be only for the purposes of running Kubernetes)
When optimizing for one thing, you often degrade another.
In our case, if we optimize for minimalism, then immutability becomes degraded.
We need to address a way to manage and debug the node, and we need libraries/binaries to do so.
With no package manager, this means everything must be baked into the image, and thus we degrade immutability.
Tacking on yet another design constraint, security,…
oorza · 2022-06-29
SecObs (https://swagitda.com/blog/posts/the-security-obstructionism-secobs-mar… at it again!