deploy: 2087f84

en/sitemap.xml

@@ -1 +1 @@
-<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml"><url><loc>https://appsec.space/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/"/></url><url><loc>https://appsec.space/tags/backdoor/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/cve-2024-3094/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/liblzma/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/posts/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/posts/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/posts/"/></url><url><loc>https://appsec.space/tags/security-engineering/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/supply-chain/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/"/></url><url><loc>https://appsec.space/posts/xz-backdoor/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/xz/</loc><lastmod>2024-03-31T08:16:39+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/categories/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/categories/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/categories/"/></url><url><loc>https://appsec.space/categories/general-knowledge/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/categories/general-knowledge/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/categories/general-knowledge/"/></url><url><loc>https://appsec.space/tags/infosec/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/infosec/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/infosec/"/></url><url><loc>https://appsec.space/tags/rants/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/rants/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/rants/"/></url><url><loc>https://appsec.space/tags/security-theatre/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/security-theatre/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/security-theatre/"/></url><url><loc>https://appsec.space/posts/security-theatre/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/posts/security-theatre/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/posts/security-theatre/"/></url><url><loc>https://appsec.space/categories/blog-news/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/posts/long-time-no-see/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/posts/long-time-no-see/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/posts/long-time-no-see/"/></url><url><loc>https://appsec.space/tags/updates/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/updates/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/updates/"/></url><url><loc>https://appsec.space/tags/ai/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/code-review/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/posts/mycroft-ai-rce/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/vocal-assistant/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/categories/vulnerability-research/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/writeup/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/about/</loc><lastmod>2023-03-21T22:11:59+01:00</lastmod><changefreq>weekly</changefreq><priority>0.5</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/about/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/about/"/></url></urlset>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml"><url><loc>https://appsec.space/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/"/></url><url><loc>https://appsec.space/tags/backdoor/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/cve-2024-3094/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/liblzma/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/posts/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/posts/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/posts/"/></url><url><loc>https://appsec.space/tags/security-engineering/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/supply-chain/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/"/></url><url><loc>https://appsec.space/posts/xz-backdoor/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/xz/</loc><lastmod>2024-03-31T08:19:06+02:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/categories/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/categories/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/categories/"/></url><url><loc>https://appsec.space/categories/general-knowledge/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/categories/general-knowledge/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/categories/general-knowledge/"/></url><url><loc>https://appsec.space/tags/infosec/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/infosec/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/infosec/"/></url><url><loc>https://appsec.space/tags/rants/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/rants/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/rants/"/></url><url><loc>https://appsec.space/tags/security-theatre/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/security-theatre/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/security-theatre/"/></url><url><loc>https://appsec.space/posts/security-theatre/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/posts/security-theatre/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/posts/security-theatre/"/></url><url><loc>https://appsec.space/categories/blog-news/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/posts/long-time-no-see/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/posts/long-time-no-see/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/posts/long-time-no-see/"/></url><url><loc>https://appsec.space/tags/updates/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/tags/updates/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/tags/updates/"/></url><url><loc>https://appsec.space/tags/ai/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/code-review/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/posts/mycroft-ai-rce/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/vocal-assistant/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/categories/vulnerability-research/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/tags/writeup/</loc><lastmod>2024-03-30T22:00:02+01:00</lastmod><changefreq>weekly</changefreq><priority>1</priority></url><url><loc>https://appsec.space/about/</loc><lastmod>2023-03-21T22:11:59+01:00</lastmod><changefreq>weekly</changefreq><priority>0.5</priority><xhtml:link rel="alternate" hreflang="it" href="https://appsec.space/it/about/"/><xhtml:link rel="alternate" hreflang="en" href="https://appsec.space/about/"/></url></urlset>

index.xml

@@ -104,8 +104,8 @@ I will just link their posts once are ready, so make sure to check the Resources
 This crashes against the fact that <code>xz</code> is an incredibly popular package available in a lot of distributions and being a dependency of many softwares.</p>
 <p>This was likely seen by the attacker as a gold mine since it was easy to get the role of maintainer of the project and push the malicious code.</p>
 <p>Since you are using a thirdy-part source for your supply chain, you have to trust someone at one point or another.
-When talking about supply chain security the reccomendations are always the same: pin the hashes and use signature verification. This will work as long as you have scenarios like a  malicious attacker compromising the dependency CICD and pushing a malicious build, account compromissions etc.</p>
-<p>But what can you do if all of a sudden, trusted maintainer goes rogue?</p>
+When talking about supply chain security the reccomendations are always the same: pin the hashes and use signature verification. This will work as long as you have scenarios like a malicious attacker compromising the dependency CICD and pushing a malicious build, account compromissions etc.</p>
+<p>But what can you do if all of a sudden, trusted maintainers goes rogue?</p>
 <p>As a standard user, unless you want (and are able to) code review every single commit from every single piece of software your OS interact with: pretty much nothing.</p>
 <p>On the other hand, developers and repository owners should really increase controls on their supply chain and include strict metrics to exclude high risk packages.
 One of the biggest gimmicks of Open Source security is people beliving that since the source code is available the code magically became safe.</p>

posts/index.xml

@@ -104,8 +104,8 @@ I will just link their posts once are ready, so make sure to check the Resources
 This crashes against the fact that <code>xz</code> is an incredibly popular package available in a lot of distributions and being a dependency of many softwares.</p>
 <p>This was likely seen by the attacker as a gold mine since it was easy to get the role of maintainer of the project and push the malicious code.</p>
 <p>Since you are using a thirdy-part source for your supply chain, you have to trust someone at one point or another.
-When talking about supply chain security the reccomendations are always the same: pin the hashes and use signature verification. This will work as long as you have scenarios like a  malicious attacker compromising the dependency CICD and pushing a malicious build, account compromissions etc.</p>
-<p>But what can you do if all of a sudden, trusted maintainer goes rogue?</p>
+When talking about supply chain security the reccomendations are always the same: pin the hashes and use signature verification. This will work as long as you have scenarios like a malicious attacker compromising the dependency CICD and pushing a malicious build, account compromissions etc.</p>
+<p>But what can you do if all of a sudden, trusted maintainers goes rogue?</p>
 <p>As a standard user, unless you want (and are able to) code review every single commit from every single piece of software your OS interact with: pretty much nothing.</p>
 <p>On the other hand, developers and repository owners should really increase controls on their supply chain and include strict metrics to exclude high risk packages.
 One of the biggest gimmicks of Open Source security is people beliving that since the source code is available the code magically became safe.</p>