RivasSec | DevSecOps, Kubernetes, AWS IAM

The DevSecOps Guide: Hardening, IAM, and Incident Response

Oliver Rivas — Sat, 15 Aug 2026 00:00:00 -0700

A hub for the DevSecOps writing on rivassec.com: IAM blast radius, TLS, incident response, and controls that hold up in production.

When the Output Carries the Signal: Claude, SynthID-Text, and the New Detection Attack Surface

Oliver Rivas — Fri, 14 Aug 2026 00:00:00 -0700

Claude's planned text watermark is embedded through token selection rather than hidden characters. Once enterprises automate on its detector, that provenance feature becomes a security control plane with spoofing, evasion, oracle, key-management, supply-chain, and policy-abuse requirements.

IAM Blast Radius Is an Architecture Problem, Not a Policy Problem

Oliver Rivas — Tue, 21 Jul 2026 00:00:00 -0700

Most IAM reviews start too late, after the account structure and trust boundaries are set. Least privilege isn't fewer actions; it's smaller failure domains.

The Discovery Layer Is Broken: Hiring as an Observability Problem

Oliver Rivas — Sat, 11 Jul 2026 00:00:00 -0700

The senior engineering market has a routing failure, not a talent shortage: resumes and funnels index for keywords and discard the signal seniors depend on.

Prompt Injection Will Become a Supply Chain Evasion Technique

Oliver Rivas — Fri, 12 Jun 2026 00:00:00 -0700

Prompt injection's threat model is older than the term. The mechanism is new, the objective is the evasion goal attackers have pursued for decades.

Bandit-Clean Pwnagotchi Plugins: How `subprocess` Goes From Risk to Routine

Oliver Rivas — Wed, 10 Jun 2026 00:00:00 -0700

Hardening a Pwnagotchi plugin against Bandit B602/B603/B607: shutil.which() full paths, argv-list calls, input validation, and the nosec discipline.

TLS Has Three Jobs. Forget the Rest.

Oliver Rivas — Thu, 04 Jun 2026 00:00:00 -0700

TLS gets easier when you stop walking the handshake and name what it's for. It does three jobs; anchor those and it becomes design, not memorization.

Adoption Is a Security Control: Notes from Paving a Road

Oliver Rivas — Thu, 21 May 2026 00:00:00 -0700

A control developers route around isn't a control. Field notes on making the secure path the easy path: 40% less remediation time, 27% less pipeline latency.

The Teensy That Failed in Public: An EFI Brute Force, Hours Late

Oliver Rivas — Thu, 21 May 2026 00:00:00 -0700

In 2013 Hackaday called my MacBook EFI brute force a failure; hours later it worked. Three rate-limiting defenses, each leaking at a different seam.

IAM Roles That Fail Loud: Small Defaults, Big Difference

Oliver Rivas — Tue, 12 May 2026 00:00:00 -0700

A small Pulumi library that treats IAM safety as a precondition: mandatory permissions boundary, no wildcard trust, no wildcard actions, every opt-out explicit.

The Trust Decay: Why Modern Hiring Has Become an Adversarial System

Oliver Rivas — Mon, 04 May 2026 00:00:00 -0700

The tech hiring pipeline has shifted from talent discovery to risk mitigation. In 2026, the engineers who get hired are the ones who are hardest to doubt.

Never Lose Connection: Multi-Phone Bluetooth Tethering for Pwnagotchi

Oliver Rivas — Tue, 22 Jul 2025 00:00:00 -0700

bt-tether-multi is a Pwnagotchi plugin for intelligent multi-phone Bluetooth tethering with automatic WAN failover and silent-disconnect recovery in the field.

Elasticsearch Snapshot Verification, Minimal Privileges

Oliver Rivas — Sun, 20 Apr 2025 00:00:00 -0700

Verify Elasticsearch snapshots without manage_snapshot: minimal API key, Prometheus-friendly script, and a public tools repo for hardened monitoring automation.

Hardening Kubernetes Deployments

Oliver Rivas — Sat, 19 Apr 2025 00:00:00 -0700

Pod-level Kubernetes guardrails aligned with the Pod Security Standards Restricted profile: non-root, no caps, read-only FS, NetworkPolicies, SA hardening.

Taming the OOM Killer: Process Priorities on Linux

Oliver Rivas — Fri, 18 Apr 2025 00:00:00 -0700

The Linux OOM Killer decides what dies under memory pressure. Protect sshd, mysqld, and other critical processes with oom_score_adj via a small script.

Catching a Nation-State Proxy: OSINT on Twitter

Oliver Rivas — Thu, 17 Apr 2025 00:00:00 -0700

In 2012 I traced a state-aligned Twitter proxy tied to Venezuela's ruling party. OSINT lessons for spotting subtle, credential-phishing nation-state infra.

The 208.5-Day Kernel Bug: Uptime, Overflow, and Risk

Oliver Rivas — Wed, 16 Apr 2025 00:00:00 -0700

A 2012 Linux kernel bug caused CPU lockups after 208.5 days of uptime due to an integer overflow in sched_clock(). RHEL 5/6 lesson: patch and observe uptime.

The 2012 Leap Second: When Time Broke Java and the Cloud

Oliver Rivas — Tue, 15 Apr 2025 00:00:00 -0700

The 2012 leap second broke Reddit, Yelp, Java apps, and more. A retrospective on how fragile timekeeping bit the cloud, and what SRE teams should do today.