Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Flutter Code Obfuscation: Hiding Your Logic
Obfuscation makes your compiled Dart code harder to reverse-engineer by renaming symbols to be unreadable. Use it in production builds to protect sensitive logic, but always save the symbol map file to decipher crash reports later.
iOS Code Signing: Apple's Digital Notary for Apps
iOS code signing is like a digital notary stamp for your app. It proves to Apple you're a trusted developer and the code hasn't been tampered with. It's mandatory for running on physical devices or submitting to the App Store.
Android App Signing: Your App's Digital Seal
Think of app signing as a digital seal for your Android app. It proves you are the author and the code hasn't been tampered with, a mandatory step for Google Play release. The biggest footgun is losing your private key, which locks you out of.
flutter_secure_storage: Secure Key-Value Pairs
flutter_secure_storage is your go-to for saving sensitive data like API tokens. Think of it as an encrypted, cross-platform key-value store that uses native Keychain on iOS and strong ciphers on Android. The footgun: it's slower and meant only for secrets.
OPA Gatekeeper: Enforce Kubernetes Policies as Code
OPA Gatekeeper is a Kubernetes admission controller using OPA to enforce policies on resources. Use it to mandate labels or block insecure images. The footgun is thinking it's just OPA; Gatekeeper adds K8s-native CRDs, auditing, and mutation capabilities.
Kubernetes Secrets: Encrypting Data at Rest
By default, Kubernetes Secrets are only base64-encoded, not encrypted. Encryption at rest makes the API server encrypt Secret data before saving to etcd, protecting against compromised backups.
Service Mesh Authorization: A Bouncer for Your Microservices
A service mesh authorization policy is a bouncer for your microservices. It moves access control from your app to the mesh, checking service identity and request details like HTTP method and path. Use it for fine-grained, Zero Trust security.
Mutual TLS (mTLS): When Services Need to Trust Each Other
mTLS is a two-way ID check for services. Both parties exchange certificates to prove their identity before communicating. Service meshes like Istio use it to secure traffic between microservices.
SPIFFE: Cryptographic Identity for Services
SPIFFE gives every service a cryptographic passport instead of a static secret. It's used in zero-trust networks for services to authenticate each other, like in a Kubernetes service mesh.
Falco: Real-Time Threat Detection for Cloud-Native
Falco is a runtime security camera, watching Linux syscalls to detect threats in real time. It's used in Kubernetes to spot abnormal behavior like privilege escalation or writing to /etc. The key is it only *detects* and *alerts*; it doesn't block threats.
Kubernetes Audit Logging: Your Cluster's Black Box Recorder
Kubernetes audit logging is the security camera for your API server, recording every API call to answer "who did what, and when?". It's essential for security forensics and compliance, but a common footgun is using a weak default or logging everything.
Kubernetes API Server Authorization Modules
Kubernetes API server authorization is like a chain of security guards. A request must get a "yes" from at least one configured module (like RBAC) to pass. This is fundamental to securing any cluster. The footgun is that the chain stops at the first "allow."
K8s Authentication: Proving Who You Are to the API Server
The K8s API Server is a vault door; authentication is proving your identity to the guard. It tries a chain of methods—like OIDC for users or tokens for pods—until one succeeds. The footgun: unauthenticated requests become `system:anonymous`, a major risk.
Kubernetes Admission Controllers: The API's Gatekeepers
Think of admission controllers as bouncers for your Kubernetes API. They intercept requests before objects are saved, enforcing custom policies like security rules or required labels. The footgun: a broken controller can block all changes to your cluster.
Pod Security Admission: Kubernetes' Built-in Guardrails
Think of Pod Security Admission (PSA) as a bouncer for your namespaces, enforcing security rules before pods can run. It applies security standards (`Privileged`, `Baseline`, `Restricted`) via simple labels.
Pod Security Standards: A Security Checklist for Pods
Pod Security Standards are a built-in security checklist for your pods. You apply a level (`Restricted`, `Baseline`, `Privileged`) to a namespace to prevent risky configurations like running as root.
Pod Security Context: Set Security Rules for Pods
A Pod Security Context defines security settings for all containers in a Pod, like setting permissions for a user group before adding users. Use it to enforce non-root execution or manage shared volume permissions.
Kubernetes RBAC: Roles vs. ClusterRoles
Think of Kubernetes RBAC Roles as permissions for a single room (a Namespace), while ClusterRoles grant access to the entire building (the cluster). Use Roles for namespaced apps and ClusterRoles for admin tasks.
Sealed Secrets: Safely Commit K8s Secrets to Git
Sealed Secrets lets you commit encrypted Kubernetes secrets to a public Git repo. In a GitOps workflow, this allows all configuration to live in version control. The footgun: a SealedSecret is a one-way street; only the target cluster can decrypt it.
Kubernetes ServiceAccounts: Identity for Pods
A ServiceAccount is an ID badge for a Pod, letting it securely talk to the Kubernetes API. It's used when your app needs to list other Pods or read Secrets.
Kubernetes Secrets: Managing Sensitive Data in Pods
A Kubernetes Secret is a dedicated object for storing sensitive data like API keys, separating them from your application code. It's used to inject database credentials or TLS certificates into pods.
Kubernetes NetworkPolicy: A Firewall for Pods
NetworkPolicy is a firewall for pods, locking down traffic in a cluster where everything can talk to everything by default. Use it to isolate services, like preventing a web frontend from directly accessing a database.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Harbor: A Private, Secure Artifact Registry
Think of Harbor as a private Docker Hub with built-in security. Use it to scan images for vulnerabilities, enforce role-based access control, and sign artifacts before deploying to Kubernetes.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.