Secure Code Development and Lessons Learned from etcd Security Audit
summary
A CNCF‑sponsored Trail of Bits audit of etcd (Go) finds multiple real bugs, not just design warnings: static analyzers (go vet, staticcheck) plus fuzzing and manual review uncover an ambiguous auth log for CN‑only users, a gateway that skips TLS validation, a metric counter bug, unsafe mkdir behavior allowing precreated 0777 dirs, and acceptance of negative compaction retention; fixes land on master and stable backports are tracked, and GitHub security advisories are used to publish CVEs and coordinated fixes.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:33Agenda
- 4:03Critical Areas
- 7:37Code Analysis
- 10:14About etcd
- 11:57etcd Security Model
- 21:43Documentation
- 26:29Conclusion
related talks
41mInside the CNCF Project Security Reviews
24mGoing Secure with Go
36mThe Devil in the Details: Kubernetes’ First Security Assessment
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
36mSaaC – Security as a Culture, the Distributed Advocacy
25mExploring Some Essential Security Checks for Any Open Source Go Project
19mFrom Code to Cloud: Embedding Security
05mLightning Talk: Improving The Security Of Your Go Applications