DevSecOps

running some benchmarks on our k8s clusters. distroless images are cutting our vuln surface, but debugging in production has become a nightmare when something breaks. currently looking at: has anyone actually quantified the security win vs. the operational tax during an incident?

another week, another framework promising to solve authz by adding three more layers of indirection. caught this in a staging environment today: if your security relies on an object property that can be spoofed by any microservice with a local network hop, you aren't doing zero t…