keithrozario.com

At the end of 2018, AWS introduced custom runtimes for Lambda functions, which provided customers a way to run applications written in languages not in the holy list of the 'Official AWS Lambda Runtimes' which include a plethora of languages.

One of a great things about Lambda functions is that you can't SSH into it.

This is a continuation in the Klayers series, where I deep dive into the architecture of Klayers.

I've been bitten by the serverless bug lately, and just completed my latest hobby project this week.

Just this week, my team was on the cusp of demo-ing a product they've been working on for the last 2 months, only for a build process to fail, just hours before the demo to some very high ranking people.

I've been really digging into Lambda Layers lately, and once you begin using layers you'll wonder how you got by without them.

Recently I found myself working with an S3 bucket of 13,000 csv files that I needed to query.

Image from wikicommons.

First a definition.

As a company, Grab has done enormously well for itself, and naturally will be the target of some hate.

Android TV boxes, are computers that stream content from the internet onto your TV.

I'm still deep in my lambda love affair.

2018 in review I started the year building out govScan.info, a site that audits .gov.my websites for TLS implementation.

Shutting Down!!

Over the past few weeks, I've been toying with lambda functions and thinking about using them for more than just APIs.

GitHub Webhooks with Serverless Just because you have webhook, doesn't mean you need a webserver.

DNS Queries on GovScan.Info This post is a very quick brain-dump of stuff I did over the weekend, in the hopes that I don't forget it :).

The security community has been abuzz with an absolutely shocker of story from Bloomberg.

Hosting an S3 site via Cloudflare From my previous post, you can see that I hosted a slide show on a subdomain on hitbgsec.keithrozario.com.

I haven’t blogged in a long while – but I have a good(ish!)

On the 20th of July, Singaporean authorities announced a data breach affecting SingHealth, the country largest healthcare group.

Recently, there was a poorly written article in The New Straits Times, that suggested the Malaysian Police would know if you were watching porn online.

Gov-TLS-Audit got a brand new domain today.

As Malaysians woke up today, to a brand new cabinet of Ministers, many have already begun expressing their dissatisfaction on the lineup.

[caption id=“attachment_6436” align=“aligncenter” width=“550”] Boy, that’s a lot of RED!

Ok, I’ve been pretty involved in the latest data breach, so here’s my side of the story.

Couple months back I started GovTLSAudit.

If you’ve come here from a link on twitter – you’d see that the address bar still says login.astro.com.my, but the site is rendering this page from my blog.

I previously wrote about how data breaches are like diamonds: They're not as rare as you think They're worth far more to you than to a thief They last forever And the recent debacle over the Astro data breach epitomizes all of these characteristics.

In 2015, I was invited to a variety program on Astro to talk about cybersecurity.

Gov TLS Audit finally has a website to complement the API.

Two weeks ago, I rage-tweeted something regarding Malaysian politics that got a lot more viral than I liked (I’ve censored out the profanity for various reasons, most notably, there are teenagers who read this blog).

Last Month, I embarked on a new project called GovTLS Audit, a simple(ish) program that would scan 1000+ government websites to check for their TLS implementation.

Let’s start this post the same way I start my day – by looking at Facebook.

Let’s start with the basics.

Last week I launched a draft of the Gov.my Audit, and this week we have version 2.0 Here’s what changed: Added More Sites.

Previously, I moaned about dermaorgan.gov.my, a site that was probably hacked but was still running without basic TLS.

220,000 is a lot of people.

Part 1: An intro to Data Breaches Let's start with some basics.

Consider this a bonus piece from my long thoughts about data breaches.

While designing sayakenahack, the biggest problem I faced was trying to write millions of rows efficiently into DynamoDB.

Posting this here first, my thoughts to follow.

I keep this blog to help me think, and over the past week, the only thing I’ve been thinking about, was sayakenahack.

I know the picture is a bit hard to read, but I wanted to make sure I had a detailed enough picture to understand the ‘innards’ of sayakenahack.

OK, this is my last post on sayakenahack.com, and I’ve got a script scheduled to run at Sunday midnight to tear down the database.

Why does sayakenahack have dummy data?

On the 19th of October, Lowyat.net reported that a user was selling the personal data of MILLIONS of Malaysians on their forum.

I haven’t blogged in a while because I’m busy studying (yes, studying) for my OSCP certification.

The fact that this RM2 company manage to raise RM500 million should be news enough, but claims that it lost all it’s money to ‘hackers’ is too hilarious for me to ignore.

Channel News Asia posted last week that hackers could steal your info by just knowing your phone number.