Steve Jarvis

BSidesLV ‘25 - Controlling Credential Chaos Talking about how to authenticate without secrets, at BSides Las Vegas, 2025.

Presented on "authenticating without secrets" today at @bsideslv.org, and it was a great experience. Excited for two more days here, this is such a great community of people. 🫶

There was a live demo of federated k8s auth, the full code for that is linked from imateapot.dev/bsideslv-cre...

When Read-Only isn’t Immutable Abusing a k8s config that may look safe to escape a container.

I submitted 2 papers to @bsideslv.org this year. One I was very excited about, on k8s and escaping a container with an overlooked "read-only" socket. It didn't get accepted, so I turned it into a blog post: imateapot.dev/when-readonl...

The second did get accepted, so come heckle me live in Vegas.

In my kid’s defense a “rectagon” should totally be a shape

Me: I’m a CORS expert, this is simple

Me 3 minutes later: Dammit CORS WTF

Ha good timing. Just fyi too, the FAQ says you can just write the purchase confirmation number on a piece of paper in your windshield. A pretty nice Plan B.

Worth it, no doubt. Hostas look great and my approach to being a green thumb is that if you start with enough, some will survive.

Tornado watch or Strava KOM weather?

Alice and the queen of hearts playing flamingo croquet

New to speaking? #BSidesLV’s #ProvingGround is your Wonderland! CFP extended to 5/9.

Work with a mentor who can help you shine even if public speaking is as uncomfortably exciting the stock market right now. Submit your first talk!

👉pretalx.com/security...

Ya I’m specifically thinking of ~100 lines of Go to do what I couldn’t quite get ‘ctr’ to do. Very possibly just avoided a RTFM issue, but that’s what I’m unsure of. In the sober light of day I’m thinking the important distinction is there’s no bug, I’m using APIs as designed, so no worries.

And if it is accepted, that cherry ended up being “here’s an exploit I made” as much as “here’s a simple example of why you don’t do this”, so going to need some ethical wisdom on what to share. It’s not wildly novel, but I couldn’t get it with the standard tools.

Y’all I got a container escape 🎉. Even in an environment I control that was way harder than I expected. Hoping it’s the cherry on top of a BSidesLV talk in August, wish me luck 🤞

Life hack, use wife’s old purse as a laptop bag, get compliments from nice strangers.

I mean it makes sense, everyone else is waayyy more likely to hurt themselves lol

Once these steel tariffs make F150s unaffordable we’ll forget all about egg prices. Problem solved.

Trump begins firings of FAA air traffic control staff just weeks after fatal DC plane crash The Trump administration has begun firing several hundred Federal Aviation Administration employees, upending staff on a busy air travel weekend and just weeks after a fatal mid-air collision in Washi...

I have a flight to DC next week. First fatal crash in decades, likely due to understaffing, then fire a few hundred more ppl. Am I overreacting for considering canceling or taking a train instead? I’ve never been nervous to get on a plane in my life but wtf.

apnews.com/article/doge...

Backdooring Your Backdoors - Another $20 Domain, More Governments After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process...

Well I should link it probably
labs.watchtowr.com/more-governm...

Did you see that recent Watchtowr blog about exactly that? The theory that webshells have backdoors and they found oodles of them. Amazing.

But what if the judge was super serious

With the power of AI & LLMs, someday Siri will be as powerful as Clippy

Summer bike racing coming on strong this year around the Twin City metro! Yours truly is promoting Joy Memorial on June 9th. If you’re interested in racing but aren’t sure how to get into it, hit me up!

I don’t wanna hear about how anyone “can’t even understand what he’s saying” at halftime today aight mom

“Requires no exertion to ride” I don’t think they rode it yet lol

Maybe I’m misunderstanding some key details, but a 150-day sentence for killing a cyclist with your car seems extremely light, especially when the driver had an extensive background of driving dangerously without a license + lied about the cyclist swerving into the vehicle lane.

Happy 49th month of 2020 🎉

Excellent. And wow it took me a minute to realize the scale of that map, I didn’t realize it went so far west. 🤯

That’s awesome thanks for recap. Do you know if there are plans to connect the Cedar Lake trail from Dunwoody to Target Field? I see on Strava maps the trail “officially” goes onto the streets there, but I don’t think it was always like that?

As you wish!

The Friends of the Saint Paul Public Library | Invest in Your Library Invest in Your Community Invest in Your Library We support libraries through fundraising, advocacy, and cultural programming. Donate Now!

I went to the Innovation Lab at St Paul Public Library today to use the laser engraver. I had non-anodized aluminum and learned that’s a no-go. They gave me other material to use, got me set up, even helped with the design. Public Libraries are stinkin amazing. ❤️

thefriends.org

I’m team killer loon flag, but the winning f1953 design is good too. New seal is excellent. I’m a sucker for a loon apparently.

For real I have a side project that hasn’t changed or probably even gotten traffic in a year renew at $76 USD. Zaps a little of the fun outta it.