#Learn365 Day-4: Unauthenticated & Exploitable JIRA Vulnerabilities

There are multiple security vulnerabilities associated with the various versions of JIRA software which are exploited in wild and is one of my personal favourite 3rd Party apps to hunt.

#BugBountyTips

(1/n)

If you missed @clare_liguori's Continuous Delivery session this week (like I did) then good news, it's available on-demand now 🎊

https://t.co/78b8sI2hHs

And here's my play-by-play for the session

🧵...

This is a typical CD pipeline in AWS.

This is far more complex than the most complex CD pipeline I have ever had! Just cos it's complex, doesn't mean it's over-engineered though. Given the blast radius, I'm glad they do releases carefully and safely.

If you look closely, beyond all the alpha, beta, gamma environments, it's one-box in a region first then the rest of the region, I assume starting with the least risky regions first.

For anyone thinking about going multi-region (after the recent Kinesis outage), this is one of the complexities you need to consider. To do multi-region right and deploy safely (minimize blast radius), this is one of the complexities you have to factor in.

This "deploy small at first then more broadly" principle applies to #serverless apps too, though you can't "deploy to one box". You can do it with canary deployments instead, CodeDeploy supports this practice for Lambda (using weighted aliases) out-of-the-box.

now that's a title screen

foolish people like to quote that "science says there are only two genders". This is incorrect.

Science instead says that in addition to the regular genders, there are 25 Science Genders, shown here. (tag yourself I'm Skull)

I have no idea how to continue with this game.
I clicked a bunch of things and the game just pauses for a second, except when I clicked electron it animated and then was replaced by... something

Quarky & Quaysoo's Turbo Science!

Turbo Science is like regular Science, but FASTER

oh I see

is this Gizmos and Gadgets but by Sierra?

One of the big promises of software is composability. You can build rich, powerful experiences out of basic building blocks.

APIs add new things to the toolbox. For example: Treasury, which lets an app/platform store, move, and track a business’

I've been a small business owner and can talk at length about SMB banking, and will later, but let's put on the software developer hat right now.

Lots of software talks about money, keeps records about money, does calculations about money, but can't *touch* money.

This is extremely frustrating when you're building SaaS apps for businesses, because you have total control over your UX right until your app needs to touch money... at which point all data about it lives in a silo you can't access.

So you generally push work to the operator.

For example, suppose you’re writing a business-in-a-box system for electricians, including an invoicing feature.

You need to be able to read bank transactions to reconcile. You probably can't. The owner can. So you ask the owner to do mind-numbing work a computer does better.

It sure would be great if your business customers had bank accounts you could actually introspect and operate on their behalves! You could just get the list of incoming payments and match against the invoices.

There is some software to write but it is not rocket science.

Infrastructure review #rc3

There were only 18 heralds for all the talks. It was really hard to pull off, this conference also started a news show. #rc3

Next is the heaven team. 1487 total angels volunteered of which 710 arrived. 76 weeks worth of work hours were done by the angels. They prepared a few goodies for the RC3 world. Badges were given to show angels. Tried to keep traditions from the conference on RC3 world. #rc3

Huge thanks to all the angels who volunteered. This conference would not be possible with the help of everyone. #rc3

Next team is the signal angels, this is the first time that people had to do remote Q&A. The procedure was quite different to the in person event. There were 157 shifts filled by 61 angels. There were 5 unfilled shifts. #rc3