Benjamin Schilz

You can’t ignore the speed of innovation in user-space implementations. From Istio v1.22 to the upcoming v1.26, ztunnel’s performance has nearly doubled. A common belief in networking performance is that running everything in the kernel—whether natively or via eBPF—is the best way to achieve high performance. However, the latest results tell a different story: user-space implementations like Linkerd and Istio significantly outperform kernel-based approaches. What’s going on? Check out John Howard’s latest blog post to learn more: 🔗 https://lnkd.in/eRiUfXfw #wireguard #cilium #istio #linkerd #kindnet #calico #IPSec

139

9 Kommentare

𝗲𝗕𝗣𝗙 𝗶𝘀 𝗯𝗲𝗰𝗼𝗺𝗶𝗻𝗴 𝘁𝗵𝗲 𝗻𝗲𝘄 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗽𝗹𝗮𝗻𝗲 𝗳𝗼𝗿 𝗺𝗼𝗱𝗲𝗿𝗻 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 Daniel Borkmann OSSNA 2025 keynote made that point clearly. eBPF has moved far beyond packet filtering into a general-purpose way to extend the Linux kernel safely, without changing kernel code. Meta runs more than 100 eBPF programs in its production load balancer. Android uses it across billions of devices for security enforcement and traffic control. With Netkit, Meta reduced namespace resolution latency from 12 seconds to 100 milliseconds. The same model is now being extended to virtual machines. Through KubeVirt and Netkit, eBPF enables a shared layer of observability, policy, and performance across containers and VMs. Borkmann also highlighted how companies like Meta, Google, and Valve are using eBPF-based schedulers in production to optimize workloads without kernel patches. AI profiling and TCP pacing are emerging areas. With verified execution, cross-platform compiler support, and growing real-world adoption, eBPF is no longer experimental. It is infrastructure. Link to the full talk: https://lnkd.in/ePhazvfS

74

1 Kommentar

We have been getting a lot of questions from customers wanting to try out the Deepseek R1 model locally with the Elasticsearch vector database. Here's a blog from David Erickson and Jakob Reiter about how you can test Deepseek R1 locally for RAG with Ollama and Kibana. Easy to do with our Elastic Playground capability. The Deepseek R1 model is definitely going to spur more open source AI innovation. I'm very excited about what this means for the future of AI and RAG. https://lnkd.in/gwnhf7xR.

566

11 Kommentare

Yesterday my colleague Daniel Skarda and I have managed to speed up the restore from #Proxmox Backup Server to Proxmox Virtual Environment by patching the way the http/2 connection is utilized so much that we can fully saturate a 10 Gbps link now. 📈 We will be working with our customer on testing these changes on a 100 Gbps connection in near future and hope to polish and submit the changes to upstream eventually. 💡 We used the Hetzner dedicated server offering in Finland. Specifically two AX52 boxes for 59 €/month with the added 10 Gbps Intel NIC on both ends (6 €/month a piece). Including the setup fee of 39 € this amounts to 2*59 € + 2* 39 € + 2* 6 € = 208 € for the first month and 130 € for each month after that. That btw. includes 2*20 TB of traffic each month. 💪 The Ryzen 7 7700 is an 8 core 16 thread processor with up to 5.3 GHz boost clock speed and 3.8 GHz base clock. This is great for testing how far you can go with single thread performance. A somewhat comparable offering could be the AWS m6g.4xlarge instance that of course does not include storage and traffic would cost $472.32 if you kept it running for 30 full days in Stockholm, Europe. That's every month, not just the first. We have published the patched library as a binary for now in Proxmox forums. We would be glad if you could give it a go on your testing infrastructure as well. #kaliszutelefonu

67

1 Kommentar

DNS IP resolvers should be neutral. There's nothing to stop a service provider from adding "features" to their DNS resolver, but expecting DNS providers to be the Internet police is a slippery slope https://lnkd.in/eQPFQhvK

66

31 Kommentare

If you're in Stockholm tomorrow for Cloud Native & Container Day, you don’t want to miss this. Kubernetes is the backbone of modern cloud environments. That’s why our very own Jonathan Kaftzan, VP of Marketing & Business Development at ARMO, is taking the stage with two powerhouse customers to share real-world insights on securing mission-critical workloads and cutting through Kubernetes security noise. 🔹 13:00-13:25 | Securing Mission Critical Workloads: NOT Mission Impossible w/ Stephen Hoekstra, Mission Critical Engineer at Schuberg Philis [Room 3 San Siro] 🔹 14:10-14:35 | Taming the Noise: Efficient Kubernetes Security Strategies w/ Jonas Larson, Head of DevOps at Proact IT Group AB [Room 3 San Siro] These talks are deep dives into how real teams are solving real security challenges in production. If you care about cutting through alert fatigue, securing workloads without slowing innovation, and making Kubernetes security actually work, these sessions are where you need to be. Jonathan’s ready. The customers are ready. The question is—are you? Details & agenda: https://lnkd.in/d6uxY6wS #CloudNative #Kubernetes #CloudSecurity #CADR #DevSecOps

43

1 Kommentar

🔗 𝐀𝐥𝐥 𝐤𝐧𝐨𝐰𝐧 𝐬𝐮𝐩𝐩𝐥𝐲-𝐜𝐡𝐚𝐢𝐧 𝐚𝐭𝐭𝐚𝐜𝐤𝐬 𝐭𝐡𝐫𝐨𝐮𝐠𝐡 𝐡𝐢𝐬𝐭𝐨𝐫𝐲 thomas strömberg has curated a dataset on software supply-chain attacks. 56 OSS projects, 59 incidents. Criteria: when an open-source project or commercial product distributed malware knowingly or unknowingly. One YAML file per incident. https://lnkd.in/gvT3r_R6 #cybersecurity

50

2 Kommentare

Wiz Research has uncovered a critical Remote Code Execution (RCE) vulnerability, CVE-2025-49844 which they’ve dubbed #RediShell, in the widely used Redis in-memory data structure store. The vulnerability has been assigned a CVSS score of 10.0. The vulnerability exploits a Use-After-Free (UAF) memory corruption bug that has existed for approximately 13 years in the Redis source code. This flaw allows a post auth attacker to send a specially crafted malicious Lua script (a feature supported by default in Redis) to escape from the Lua sandbox and achieve arbitrary native code execution on the Redis host. This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments. Fixes have been released by the Redis team.

50

5 Kommentare

How to build a Gemini-CLI extension! I really believe GCEs will explode in popularity and availability over the next few weeks to months and wanted to show you exactly how to build one! This one will be a Subnet Calculator Extension for Gemini-CLI ! This includes an MCP server that has a tool decorating the Python used to perform subnet calculation given a CIDR address. I will show you how to setup your gemini-extension.json file and how to best incorporate your MCP server - virtual environment packages and all - as well as how to add custom slash commands - all easily installed from GitHub in 1 command! This is like VS Code extensions and has a bit of a Docker-esque feel to it - simplifying and reducing friction between MCP and Gemini-CLI developers and users / consumers. Repo: https://lnkd.in/eavfZyxC Installation instructions: gemini extensions install https://lnkd.in/evX5Jx_k Video: https://lnkd.in/ebMt9ZkT

47

1 Kommentar

🔐 5 Days of MCP Server Downstream [Anti] Patterns 👉 Day 2: Client Acquires External Token → Passthrough via MCP → External API Here’s how it works: 🔹 User acquires secrets (tokens/keys/passwords) for a downstream API 🔹 User gives these secrets to the MCP client 🔹 MCP client calls the MCP server with those secrets 🔹 MCP server passes them along to the downstream API 🔹 Downstream API thinks it’s talking to the user ⚖️ Pros ✅ Easy to implement/convenient ✅ Can be done right now (doesn't need spec updates) ✅ Eliminates all-access admin tokens from the MCP server (see Day 1 pattern) ⚠️ Cons ❌ Disconnect MCP validation and policy enforcement from downstream usage ❌ Unclear security boundaries: who was the token issued to? are they authorized to make these calls? if handed off, is the recipient allowed to make calls? Can the downstream API trust that there has not been a compromise? ❌ In some cases, the MCP clients/agents are public/third-party and should not be trusted with sensitive downstream API tokens, even for passthrough ❌ MCP server gets tricked into doing something with a co-opted/stolen token or co-opting an in-progress session with passed through token (confused deputy) ❌ Auditing and attribution becomes messy. Where did these calls come from? 🚫 Recommendation: 𝐃𝐎 𝐍𝐎𝐓 𝐃𝐎 𝐓𝐇𝐈𝐒. ✨ In Day 1, we saw the “god token” problem. ✨ In Day 2, we see why passthrough tokens are just as bad. Neither of these are great. In fact, they could be considered "anti-patterns". What to do? More to explore in the coming days. Connect and Follow along! #modelcontextprotocol #mcp #downstream #security #antipattern #pattern

46

3 Kommentare

Security teams have been told to ‘respond faster.’ But in the cloud and AI era, the real advantage comes from acting the instant risk emerges without waiting for people to catch up... That’s why we built automation into the core of Sentra’s Data Security Platform. - Real-time discovery - Accurate classification - Context-aware remediation All designed to help teams move from reactive alerts to proactive protection without adding complexity. In our latest blog post, Gilad Golani and I share why automation is now essential to securing sensitive data, how we’ve built it at Sentra, and what it takes to address risk at machine speed. Read it here 👇 https://lnkd.in/dWpHYhk6

30

EIC 2025 opened up with Martin Kuppinger sharing 7 trends shaping Identity Access Management's present and future. Here they are: 𝟭. 𝗣𝗼𝗹𝗶𝗰𝘆-𝗯𝗮𝘀𝗲𝗱 𝗮𝗰𝗰𝗲𝘀𝘀 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 Zero standing privileges with decisions based on static data shifting towards autonomous, AI-based decisions, beyond policies. 𝟮. 𝗠𝗼𝗱𝘂𝗹𝗮𝗿, 𝗺𝗼𝗱𝗲𝗿𝗻 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲𝘀 Microservices and flexible deployment models (containers, serverless), exposed via APls. 𝟯. 𝗢𝗿𝗰𝗵𝗲𝘀𝘁𝗿𝗮𝘁𝗶𝗼𝗻 Loosely coupled systems will benefit from decentralized (desiloed) identities, and see decoupling of data from functionality and UX. 𝟰. 𝗗𝗲𝗰𝗲𝗻𝘁𝗿𝗮𝗹𝗶𝘇𝗲𝗱 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 No identity silos anymore, everything becomes a credential backed by dynamic authorization schemes. And no more single point of attack on identities. 𝟱. 𝗦𝗶𝗴𝗻𝗮𝗹 𝘀𝗵𝗮𝗿𝗶𝗻𝗴 Everything from context, risk, to data is a signal, and sharing these is the foundation for autonomous identity and for the next generation of authentication. More signals = more strength 𝟲. 𝗔𝘂𝘁𝗼𝗻𝗼𝗺𝗼𝘂𝘀 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 AI-powered decisions will happen, but non-human IAM requires an autonomous identity to scale, and autonomous OT & smart infrastructures mandate an autonomous identity. 𝟳. 𝗔𝗹𝗱𝗲𝗻𝘁𝗶𝘁𝘆 This is what Martin calls the intersection of Al and Identity, where Al already helps in authentication decisions, will help in authorization decisions, and is essential for autonomous identity. Great opening keynote!

27

🚨 New VMScape Spectre-BTI Attack Exploits Isolation Gaps in AMD and Intel CPUs | Read more: https://lnkd.in/gAkxGjt2 A novel speculative execution attack named VMSCAPE allows a malicious virtual machine (VM) to breach its security boundaries and steal sensitive data, like cryptographic keys, directly from its host system. The vulnerability, identified as CVE-2025-40300, affects a wide range of modern processors, including all current generations of AMD Zen (1 through 5) and Intel's Coffee Lake CPUs. VMSCAPE's success hinges on the discovery of incomplete isolation within the CPU's Branch Prediction Unit (BPU). #cybersecuritynews #vulnerability

121

5 Kommentare