CommPulse

Sounds like someone wants to go on-call. You too can enjoy being paged at 2am for a flaky disk, a cron job related traffic spike, and AWS outage, or any of the wonderful things pagers get paged on. And you can re-read your essay after being awakened repeatedly for false alerts, knowing that non-prod alerts are now first class citizens and you are their Shepherd. Tldr? Go ahead and page yourself for non-prod alerts. No one will stop you.

I’ve been working on an open-source reference implementation of an agentic DevSecOps container-release pipeline. The goal was to keep security decisions deterministic while using an AI agent only to explain findings, prioritize remediation, and make scanner output easier for engineering teams to act on. The pipeline includes: zSonarQube source-code and quality analysis Trivy Dockerfile and Kubernetes misconfiguration scanning Local container-image build Trivy vulnerability and embedded-secret scanning Deterministic release-policy evaluation Claude Sonnet 5 or Google ADK advisory triage HTML, PDF, Markdown, JSON, and SARIF reports Email delivery through Resend Discord notifications Protected human approval Docker Hub publishing only after authorization For the demonstration, the workflow processed an intentionally insecure training fixture and found: 13 SonarQube findings 25 configuration misconfigurations 347 container-image vulnerabilities 372 total Trivy findings 74 policy-blocking findings The workflow continued scanning long enough to collect complete evidence, but the deterministic policy kept the release BLOCKED . Human approval and image publishing were skipped. The Claude advisory successfully analyzed a bounded subset of the scanner evidence. It prioritized remediation and explained possible attack paths, but it could not approve, reject, waive, or override the deterministic policy. The design principle is: The pipeline generates three primary reports: Code and configuration security report Container vulnerability and secret report Consolidated release-security report Repository: https://github.com/DevOpsAIguru123/awesome-agentic-devops/tree/main/agents/container-image-release-advisor Demonstration run: https://github.com/DevOpsAIguru123/awesome-agentic-devops/actions/runs/30590931717 This is an open-source reference implementation rather than a universal production template. Production adoption would require organization-specific policies, isolated builds, artifact signing, provenance, registry controls, and continuous monitoring. I’d appreciate feedback on: Whether AI advisory analysis belongs inside the release pipeline or should run asynchronously How you deliver security findings without overwhelming developers Which additional supply-chain controls you would add Whether a deliberately blocked security workflow should appear red or use a successful “blocked as designed” conclusion submitted by /u/Individual_Walrus425 [link] [comments]

I’m more of a network guy, I don’t work on web servers all that much. I have an internal server, A, that allows external traffic on port 4040, and there is an external server, B, somewhere on the internet that wants to pull data from A. But I want to run all network traffic through a DMZ first, so I put a VM running nginx inside the DMZ… And here is where my understanding gets a bit fuzzy. Server B points to the public IP of the proxy server and sends its request > nginx on the proxy server receives the request from server B and then passes that request to server A > ??? How does server A know to send the requested data to the proxy server? Is there anything I need to configure on server A so it sends the data to the correct server? Also, just ignore any firewall rules in this scenario, I’m not concerned about that. Thanks submitted by /u/heavyPacket [link] [comments]

We are going to require privileged admins to use device bound passkeys, but we are considering allowing synced passkeys for standard users due to Android version compatibility with device bound passkeys. We cannot require everyone to have Android 15 or higher to reliably support device bound passkeys. Using synced passkeys will allow users who were using SMS 2FA to avoid installing dedicated work apps on their personal phones. Synced passkeys work with the pre-installed iOS and Android password managers plus some third party password managers they may already have installed. However, syncing passkeys has certain risks that using the Microsoft Authenticator app doesn’t have. The Authenticator app Microsoft Work credentials do not sync to every device the user signs in to, unlike synced passkeys. Does this make using synced passkeys for Entra sign in more of a security risk than using password plus 2FA via an authenticator app? submitted by /u/Fabulous_Cow_4714 [link] [comments]

Was checking out ServerHunter and saw Nonic cloud. I'm looking for high bandwidth VPS's and it seems like a really good deal, almost too good to be true... Curious if people have had positive/negative experiences with it? From what I could find so far: https://oxide.host/ seems to be https://nonic.cloud/ with the same servers at a higher price...? Seems relatively small, can't find many reviews on it No throttling in AUP...

Hello, I am looking for cheapest VPS in Singpore that will mainly to be used for hosting Pangolin Tunnel. As AWS free trial will be end in a month. The specification is listed below: 1 vCPU 1 GB of Ram 20 GB Storage 1TB bandwidth (option to increase the bandwidth is nice to have as optional option) 1 Static IPv4 The main priority is network stability, and low latency that I could test. The budget around 2-3 USD or 3.5 to 4.5 AUD per month if AUD currency is available.

https://preview.redd.it/py187mvx1ogh1.png?width=1055&format=png&auto=webp&s=7ab6509afed08b26651a52697514c88dd05ca01e Does anyone know what this is? I don't have an IAM user with this name. It appeared as an AWS::STS::AssumedRole entry in CloudTrail. I've searched everywhere, but I couldn't find any reference to it. submitted by /u/luizarodrigues [link] [comments]

Despite mixed feelings on AI, I've been put in charge of deploying enterprise AI and internal agents. Management wants productivity ROI. The problem? Our IT environment is structurally hostile to automation. We run Windows 11 on 16GB laptops with a kernel-level DRM client that: · Encrypts every single file automatically · Blocks screenshots and copy-paste · Logs every file action Add 3 cloud drives (only 1 used), 2 endpoint managers, app blockers, disk encryption, Teams, Copilot, and a separate HQ chat suite. Machines burn out constantly. Culturally, we're zero-trust and hierarchical—speaking up is discouraged. Yet my division is all highly vetted researchers (Masters/PhDs) generating our own IP, no trade secrets. Everything we encrypt is literally the output of our own brains. My AI-ready vision: configurable sandboxes for agents, 100% trust for senior talent (managed via education), AI-first comms, on-prem RAG/backups, selective encryption, biometric MFA, frontier pen-testing, and ZDR with AI labs. Our investment becomes browser Q&A chatbot (pushing employees to leak data into personal ChatGPT to get real work done.) The question: Is there a sensible staged migration path from this mess, or is the DRM architecture so foundational that we need a greenfield rebuild? Our sys admin is solid - he’s just following mandate from above. The problem (I believe) is the decision makers operate with a strict top down mindset and I assume each manager has gone for the safest move to CYA. Is this a stupid idea to ask my sysadmin to brainstorm a greenfield pilot architecture I could possibly make a business case for? Or should I find a way to pass the buck like everyone else? submitted by /u/Jealous-Depth487 [link] [comments]

hello, i'm not happy with my lumadock micro vps that i'm using to wg'in the qbittorrent. i'm looking for a micro vps instance by trusted provider that has: -1g or up port, -at least 10tb/mo bw or ul, -should allow torrenting, -eu, usa, canada locations, -maximum budget is 80 usd-eur/annual thanks,

I need a solution for sharing passwords. Current solution that everyone loves: You go to a website. You can enter a password, or have one generated for you. It gives you a public URL. You can choose it to be valid once or for up to 7 days. You give the link to a user, customer, client, whoever. They click it, they get the password in plain text in their browser window. Done. Problem: it's running on an EOL OS, the original programmer is long gone. Need something you get a link, you click it, you get the password. No auth required, can work publicly with no VPN. SaaS solution preferred. submitted by /u/adamtw1010 [link] [comments]

Based on the technical breakdown OpenRemote's maintainers published in their own GitHub Security Advisory earlier this month, here's the architectural impact: The public console registration endpoint is designed for anonymous first-boot enrollment — new console, no creds, register itself. Fine pattern. The problem is the same endpoint's update path: if the submitted id matches an existing console asset, the backend loads it and applies attacker-controlled fields (push provider data, name, version, platform) with no auth header, no ownership check, no realm match. Straight IDOR (CWE-639) sitting in a public write path. Attack precondition is just knowing a valid console asset ID — and the advisory flags that these leak through logs, URLs, API responses, backups, telemetry, support tickets. Not a high bar. Impact: attacker-controlled push token persists on the victim console, redirecting or killing legit notification delivery. Worse in multi-tenant deployments since there's no realm binding at all. Patched in 1.26.2. No CVE indexed on NVD yet as far as I can tell (VulnCheck/other trackers cite CVE-2026-66013, GitHub's own page says "no known CVE" — worth independently verifying before you cite it that way). Wrote up the full attack chain + remediation checklist here for more background: https://www.techgines.com/post/openremote-authentication-bypass-vulnerability-cve-2026-66013 Anyone else seeing IDOR-class bugs specifically in IoT/console registration flows as the pattern replacing classic auth-bypass CVEs this year? Curious if this is a trend in device-onboarding APIs generally or just an OpenRemote-specific miss. submitted by /u/Expert_Sort7434 [link] [comments]

I love this one. Only 18/year ali service. No substitute. But it has been dead.

Hi all, Have you ever seen this error on your Dell servers? I’m not sure if this is hardware or firmware issue. Usually prior to this event, the client loses power and then server cannot be powered on again. I either need to remove power supplies and drain the power or in some rare cases, I needed to remove DIMM’s and reconnect. Then it starts okay. More details on errors seen from iDRAC console: The system board fail-safe voltage is outside of range. CPU 1 M23 VTT PG voltage is outside of range. CPU 1 M01 VTT PG voltage is outside of range. CPU 1 M01 VDDQ PG voltage is outside of range. CPU 2 VCORE PG voltage is outside of range. The system is PowerEdge T430, BIOS, iDRAC are on the latest versions. Can it be RAM or settings or hardware failure? TIA. submitted by /u/Le085 [link] [comments]

submitted by /u/ryanmerket [link] [comments]

According to the calendar on https://guards.re , summer has officially arrived on LowEndTalk! 🏖️ Grab your popcorn, because summer hosting season means it is time for the annual low-end- circus. Active Summer Host Features The bedroom special : a server running entirely on a dusty desktop tower under a teenager's bed, cooled by a single household desk fan. The master of disguise : a brand new provider that registered their domain exactly four days ago, where the frontpage confidently claims they have over 10 years of enterprise data center experience. If questioned, the patron provider would explain that they previously had a different brand serving only domestic customers. The infinite resource : a $1/year VPS that offers unlimited storage, unlimited bandwidth, and a 10Gbps port. It will be suspended for violating fair use when four users try to install WordPress at the same time. The magic backup : a premium tier offering fully automated, multi-region daily backups. The backups exist in the owner's dreams and will disappear as soon as they main server fails. Already Deadpooled SalmonCloud Ltd (2025-Jul) ConfigServer (2025-Aug) Upstream Network Ltd / ZHNET (2025-Nov) Atomic Networks (2025-Dec) Lewis / Velox Media (2026-Jan) Signs a Host Will Deadpool Before End of Summer You can spot an unstable host early by asking the right technical and operational questions. Watch out for these major red flags when looking at the dealz: They rent everything and own nothing : they will vanish when their hardware and IPv4 space bills come due. They charge a massive fee to buy a single extra IPv4 : they have a limited network and cannot scale their operations. They completely ban custom ISOs on KVM plans : they are over-allocating their nodes and hiding a broken control panel. They do not list a real data center name or address : your data is probably located in a basement guarded by two very scary dogs. They lack a clear policy on persistent CPU and port blasting : neighbors will crash the infrastructure by July. They refuse to publish YABS benchmark data : they are hiding weak hardware that will melt under summer heat. Good Luck This Summer Are you looking to buy a server this summer? Remember to use a credit card with excellent fraud protection, backup your data daily to an external drive, and never buy a lifetime plan unless you expect that lifetime to last about two weeks.

Just curious how everyone is doing this without reliance on what Accounting uses for their books. If you are given $x budget, how are you keeping tracking of what is spent where, how much on a server, hardware, licenses, etc. If there a centralized way to keep track of all of this that ideally ties into some CMDB or Inventory system for hardware/software. Or is Excel the way to go? submitted by /u/Jaki_Shell [link] [comments]

I got ip-banned and they told me it was because I had a typo in a URL I entered. The last time I got banned, they said "pressing enter too fast may trigger it". I've not once in my entire life of using the internet (20+ years) have encountered such an annoyingly touchy website. No, this is not some credential based website, a banking website, a government website, or anything high-risk. submitted by /u/ToshPointNo [link] [comments]

Its kind of getting on my nerves and being a Debbie downer for my mood... I'm not used to all this praise. Thanks! submitted by /u/Finn_Storm [link] [comments]

https://craphound.com/overclocked/Cory_Doctorow_-_Overclocked_-_When_Sysadmins_Ruled_the_Earth.html Introduction to When Sysadmins Ruled the Earth Introduction I’ve changed careers every two or three years ever since I dropped out of university in 1990, and one of the best gigs I ever had was working as a freelance systems administrator, working in the steam tunnels of the information age, pulling cables, configuring machines, keeping the backups running, kicking the network in its soft and vulnerable places. Sysadmins are the unsung heroes of the century, and if they’re not busting you for sending racy IMs, or engaging in unprofessional email conduct it’s purely out of their own goodwill. submitted by /u/Eddit13 [link] [comments]

🚀 SPECIAL OFFER Reply to this topic with your order number and choose ONE of the following FREE upgrades: 🚀 Double your bandwidth 💾 Double your SSD storage 🧠 Double your vCPU cores Simply comment with your order number and let us know which upgrade you'd like! 💼 KVM VPS Plans – High Performance @ 10 Gbps Note: Inbound bandwidth is unmetered . Only outbound traffic counts toward your usage limit. SSD Storage RAM vCPU Bandwidth (Outbound) Monthly Price Triennial Price 55 GB 1 GB 1 2 TB @ 10 Gbps $3/mo $2.25/mo 80 GB 2 GB 1 4 TB @ 10 Gbps $6/mo $4.50/mo 160 GB 4 GB 2 6 TB @ 10 Gbps — $9/mo 🌐 About Ethernet Servers Ethernet Servers has been providing reliable hosting solutions since July 2014 . All KVM-based VPS plans include: Instant deployment VirtFusion Control Panel 1x IPv4 + /64 IPv6 Full root access DDoS Protection 💳 Payment Methods: PayPal, Alipay, Credit/Debit Card, and many cryptocurrencies. 📍 Locations & Test IPs Location Facility Test IPv4 Test IPv6 Los Angeles, US Equinix 64.31.6.238 2a09:e683:5::1 New Jersey, US Equinix 64.31.14.238 2a09:e683:6::1 Miami, US Digital Realty 64.31.17.238 2a09:e683:8::1 London, UK Equinix 64.31.44.180 2a09:e683:9::1 Frankfurt, DE Equinix 208.115.231.237 2a09:e683:7::1 YABS Benchmarks: We operate a mixture of hardware and do not provide a single YABS benchmark. Publishing one result could create incorrect expectations, as the exact CPU model, storage performance and other benchmark results may vary depending on the host server your VPS is deployed on. 💿 Available Operating Systems We currently offer the following operating systems: AlmaLinux: 8, 9, 10 AlmaLinux Desktop: 9 with GNOME Desktop 4 GB plan or larger required Alpine Linux: 3.23 Arch Linux CentOS Stream: 9 CloudLinux: 9 Debian: 11, 12, 13 Debian Desktop: 13 with XFCE Desktop or GNOME Desktop Fedora: 43 FreeBSD: 15 Oracle Linux: 8, 9 openSUSE: Leap 16 Minimal, Tumbleweed Rocky Linux: 8, 9, 10 Rocky Linux Desktop: 9 with GNOME Desktop 4 GB plan or larger required Ubuntu: 22.04, 24.04, 26.04 Windows Server — 180-day evaluation: 2019, 2022, 2025 4 GB plan or larger required Customers may also upload and install their own ISO through the VirtFusion control panel. 🖥️ Free Software Installation Service We also offer FREE installation of the following upon request via a support ticket: OpenVPN — VPN server WireGuard — VPN server Hestia Control Panel — website control panel Virtualmin — website control panel Webmin — website control panel CyberPanel — website control panel cPanel — you will need to supply the licence DirectAdmin — you will need to supply the licence Webuzo — you will need to supply the licence 📬 Questions? Contact us — we’re here to help! 🟢 Thank you for choosing Ethernet Servers !