Sometimes context is missed in security updates; never mind
I’ve been running my new dismiss-alerts workflow in my personal projects for a while now, and it’s working well enough. However, recently there have been a spate of security alerts for things that I genuinely don’t have control over and also I can immediately see have no relevance to me. A case in point here is the Apache HTTP vulnerabilities that are transient from the AWS Java SDK; they were reported on by dependabot in my aws-kms-csr project which is essentially a one-shot commandline tool wrapped by gradle to create a CSR using your AWS KMS keys.
Like my docs, I like my ‘reasons’ to be next to my source code…
Recently the organisation that I’m with has migrated to GitHub. This means that I don’t need to wrestle with how BitBucket is an utter shambles when it comes to interacting with my preferred terminal based workflow (I could forgive it a lot more when it still supported Mercurial). I can retire bitbucket-pr as some kind of low-rent GitHub CLI replacement (I was teetering on the rabbit-hole edge where I was gonna go full rust/golang on the whole scripto nonsense).
Anyway, the move to GitHub hasn’t been without its wrinkles; not least of which is that we have a license for snyk and dependabot is habitually ‘hassling us’ with its alerts (is there a day where a nodejs alert isn’t raised?). Some of those vulnerabilities we had traditionally been suppressing with a .snyk file.
Oh, GitHub has a CLI tool, which we can make do whatever we want!
The principle of least surprise is a thing, but not for prometheus-community
It’s fascinating to subscribe and use open source community releases. If you’re not a hard-core user, more of a dabbling amateur then you don’t know the ins and outs of the product. That leaves you at a slight disadvantage when upgrades come around. This was certainly the case when I upgraded my kube-prometheus-stack from 76.4.x to 77.x. All my existing Grafana dashboards lovingly curated by me had disappeared!
Well, it has come to pass that any images that have git installed on them, and are based on debian bookworm (which is a fair number of images, given that trixie is still relatively new) will trigger a security vulnerability because of CVE-2025-48384 which is very cool. Boom, the security team are telling you that you have to patch all the things because it’s classed as a HIGH vulnerability (and 8.0 is high).
Never bothered upgrading to a fixed IP Address, how sad.
I’ve been with BT Broadband since pretty much its inception; it hasn’t been awful, and I’ve never been a fan of the race to the bottom. I remember the old Alcatel frog modem and all the joys that entailed; one of the things that I’ve never bothered with is having a fixed IP Address; didn’t really see the point what with VPNs and all that. However, recently, for work purposes they wanted to have a whitelist of IP Addresses that could access non-functional testing services.