Eric Chiang
@ericchiang.bsky.social
@oblique.security. Ex Google Security, CoreOS. ericchiang.github.io
I wrote about our team’s code review norms, which I am grateful are deeply human.
Oblique@oblique.security · 5mo agoA coworker disappearing into a cave and coming back with 12,000 lines of code you have to review is cause for a heart attack. But, how do you handle the ever-increasing volume of code reviews? Our engineering team wrote down how we navigate code reviews at Oblique: oblique.security/blog/how-obl...
Who do I know who's going to be in town for bsides or RSA?
Turns out, I'm the only one who didn't know about the passkey PRF extension. Wrote up a post about using it for end-to-end encryption! oblique.security/blog/passkey...
Passkey PRFs for end-to-end encryption | Oblique
The passkey PRF extension lets syncable credentials do much more than login users. See how apps are using this for end-to-end encryption.
oblique.security
🚨 Tap and Ride is LIVE! 🚨 Starting today, you can pay for BART right at the fare gates with a 💳 contactless-enabled debit or credit card or use 🤳 mobile payment, like Apple Pay and Google Pay. There is zero registration or setup process required.
Wrote about a fun @golang.org type trick where APIs can force clients to pass string constants as arguments. Happens to be _extremely_ useful for SQL builders! oblique.security/blog/injecti...
Injection-proof SQL builders in Go | Oblique
SQL builders are always one bad logic bug away from full-blown query injection. This post covers how Oblique uses Go type tricks to prevent this entire class of backend issues.
oblique.security
How can you use a Terraform Provider to automate your Permission System? Well, that's what @veronicalg.bsky.social is going to tell us in this livestream later today. It's Office Hours format so bring any questions you may have. www.youtube.com/live/OlQ70bq...
Use Terraform Providers to Automate Your Permission System
AuthZed now has a Terraform and OpenTofu Provider for the AuthZed Cloud API! This provider automates the management of resources in AuthZed Dedicated environments: Service accounts for programma...
youtube.com
It turns out workload identity isn't a complete mess in 2025 (only a little one)? Wrote a bit about authenticating GitHub Actions identity directly using OpenID Connect.
Oblique@oblique.security · last yr.Instead of minting long-lived API keys, you can use GitHub Actions' OpenID Connect support for workload identity. Here's how we authenticate config-as-code workflows in Oblique without secret management headaches. Better security + Better developer experience 💟 oblique.security/blog/github-...
Oh hey, what's this fancy new IAM company?
Oblique@oblique.security · last yr.Identity management has quietly become the primary security perimeter. But it's a mess — identity requires constant manual work that security teams burn out from. At Oblique, we're helping organizations make their access controls actually maintainable. Full post: oblique.security/blog/identit...
A friend needs a Workday test instance to build something interesting. Anyone know how to get one? (A Workday instance; I kinda already know how to get a friend.)
Every day I'm glad my job isn't staring into the IAM abyss of a large Cloud org. matduggan.com/iam-is-the-w...
Every time you feel useless, remember that GitHub as a notifications tab
who needs coherent cyber policy when we excel so much at corporate ligation? www.nytimes.com/2025/05/06/t...
Meta Awarded $167 Million in Damages From Israeli Cybersecurity Firm
nytimes.com
New experimental garbage collector for Go programs! github.com/golang/go/is...
runtime: green tea garbage collector · Issue #73581 · golang/go
Green Tea 🍵 Garbage Collector Authors: Michael Knyszek, Austin Clements Updated: 2 May 2025 This issue tracks the design and implementation of the Green Tea garbage collector. As of the last update...
github.com
📣Today, we’re super excited to announce our latest product addition: Continuous Profiling for GPUs! Check out the use cases and sign up for early access on the announcement post! 🔥📈 www.polarsignals.com/blog/posts/2...
Scraping Kubernetes codebases for os/exec continues to pay dividends www.wiz.io/blog/ingress...
Remote Code Execution Vulnerabilities in Ingress NGINX | Wiz Blog
Wiz Research uncovered RCE vulnerabilities (CVE-2025-1097, 1098, 24514, 1974) in Ingress NGINX for Kubernetes allowing cluster-wide secret access.
wiz.io
"middleware:middleware:middleware:middleware:middleware" is the new bloody mary zhero-web-sec.github.io/research-and...
Next.js and the corrupt middleware: the authorizing artifact
CVE-2025-29927
zhero-web-sec.github.io
Awesome to see Landlock making unprivileged isolation so easy. As someone who maintained bubblewrap jails, I'm hoping that this takes over user namespaces. Things like network controls are always mess there. github.com/Zouuup/landrun
GitHub - Zouuup/landrun: Run any Linux process in a secure, unprivileged sandbox using Landlock LSM. Think firejail, but lightweight, user-friendly, and baked into the kernel.
Run any Linux process in a secure, unprivileged sandbox using Landlock LSM. Think firejail, but lightweight, user-friendly, and baked into the kernel. - Zouuup/landrun
github.com
"No way to see this coming" says only auth protocol with regular auth bypasses github.blog/security/sig...
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.
github.blog
On my way to New York! I’ll be in there from Monday until Thursday evening, and still have some room to meet on Wednesday afternoon, anyone want to chat databases/observability/performance? Feel free to DM me!
I finally read up NVIDIA Confidential Compute, so you don't have to! Surely this will make all of our AI secure ericchiang.github.io/post/confide...
Eric Chiang | Confidential Compute and GPUs
ericchiang.github.io
Do OSS, it'll be fun! *Ten years later and still getting reports on my day off about other people's buggy implementations*
According to Giraffe Security, AWS staff have somehow managed to re-introduce the same RCE vulnerability into its platform three times over the past four years giraffesecurity.dev/posts/amazon...
One of the coolest pieces of security tech I read about in 2024 was PyPI's builder identity verification done by Trail Of Bits. Didn't see much fanfare in my feeds when it was published, but defiantly worth the read. blog.trailofbits.com/2024/11/14/a...
Attestations: A new generation of signatures on PyPI
For the past year, we’ve worked with the Python Package Index (PyPI) on a new security feature for the Python ecosystem: index-hosted digital attestations, as specified in PEP 740. These attestatio…
blog.trailofbits.com
Streaming media DRM has nothing to do with TPMs and the FSF is just plain wrong: mjg59.dreamwidth.org/70954.html
If the rust compiler is slow, why don't rustaceans simply rewrite it in rust?
Jimmy Zelinskie@jimmy.zelinskie.com · 2y agowriting Rust libraries feels like such a burden of always trying to decide "would my users prefer ergonomics or shorter compile time?"