Back to tags
#lazy-sre
the sre playbook for people who'd rather automate it than carry the pager.
6 blog posts.
The Lazy Security series: six parts on the security work a small team will actually execute. The premise is that the configuration which makes the wrong thing impossible beats the runbook that only discourages it. Part 1 is npm and the dependencies you didn't read. Part 2 is SHA pinning, dependency cooldowns, and pull_request_target. Part 3 is the unsexy list — identity, audit logs, the PAT you forgot. Part 4 is SPF, DKIM, DMARC and CAA. Part 5 treats the dev laptop as the perimeter, and part 6 is the network in front of everything.
Blog posts
Ivanti made everyone re-read their VPN architecture in January 2024. Tailscale, Cloudflare Tunnel, and WireGuard in one afternoon.
Snowflake taught everyone what happens when an infostealer runs on a contractor's personal Mac. The laptop is the perimeter.
Four DNS records that close the entire phishing-impersonation class: SPF, DKIM, DMARC, and CAA, plus two monitors, set up correctly in one afternoon.
Identity, network access, default credentials, attestation, and audit logs: the unsexy DevSecOps controls that close most of the gap Parts 1 and 2 left…
Hardening GitHub Actions for small teams: SHA pinning against tag rewrites, OIDC over long-lived secrets, dependency cooldowns, and the trigger to never…
Startup-grade defense against npm supply-chain attacks, for Future You at 3am. Chainjacking, postinstall scripts, smallest install, most leverage.