okta is not "active-active" in a multi-region sense, they run in a single active AWS single Region per-tenant. You can pay extra to have a faster failover in a region level failure scenario:
What about "access controls" for the AuthZ side, instead of Permissions?
Wondering HNs collective wisdom on this-- at work we've been using Access Controls on our homepage for awhile- https://www.conductorone.com/ - to the people outside the IAM-geek space does this make more sense?
The API for Let's Encrypt to do this requires possession of the private key, which pwned keys doesn't always have. Sometimes they just have an "attestation" of compromise:
You can also just, Log the spans as they are being created to stderr/stdout -- I've done this on a previous project with this approach of "spans first".
It made it debuggable via output if needed, but the primary consumption became span oriented.
1) Your post mentions "Ranking", and while do the most impactful work first is great, the method I have most often used is when dealing with Vuln-overload is to "Reclassify". That is Common Vulnerability Scoring System (CVSS) (super flawed as it is) has let reporters check the box for "remotely exploitable" therefore its a 8.0 HIGH vulnerability -- but I think your product could let me reclassify the vuln to a medium/low - maybe a built in CVSS score editor?
2) One other thing there should also be a built-in concept of "accepting the risk" -- and ideally a concrete report of what was previously "accepted", and if that package gets used in new ways?
3) I'm curious what you think about market segmentation in this space? Specifically the sub-200? person companies seem to be using alot of the "all in one" Compliance platforms (eg, Vanta, Drata, etc). Vanta for example does have a vuln management + SLA tracking dashboard + ticketing tools.
Its cool to see the automation the kubernetes team stuff does against Github -- but has it been expanded to other resources, eg AWS or some other SaaS used?
Other thought I had, is there any concept of expiration of permissions?
Something I ran into when I used to do more Apache Software Foundation work was that, we had thousands of committers with shell access -- but 94% never used it. Are any of the things protected by this privileged? eg, a release private key?
i've also been working on a similar tool -- working towards open sourcing it too. would you be interested in taking a look? paul.quenra at conductorone com
We would start a Postgres Process. We would create a new database, run all of our migrations and basic data bring up. Then we would create a new Database per Test Suite, using the one we just ran migrations as the Template.
This meant the initial bring up was a few seconds, but then each test suite would get a new database in a dozen milliseconds (IIRC).
> In June 2012, he became an advisor and received options for shares in the company Sumo Logic, Inc. The next month, Kail authorized and signed on behalf of Netflix a vendor agreement between Netflix and Sumo Logic.
"Ex-Intel executives raise $21.5 million for RISC-V chip startup":
https://www.aheadcomputing.com/
I believe the founding team is all in Oregon - and mostly all ex-Intel.