SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Exposed Flink dashboards can enable job submission; search counts are not exposure estimates

0
·1 views

An analysis of ZoomEye search results for Apache Flink dashboards found tens of thousands of fingerprint matches, but the author argues these counts measure query design rather than how many dashboards are truly exposed. The Flink Web UI goes beyond read-only monitoring, allowing job submission, savepoint triggering, and access to job graphs, checkpoints, and configuration. Because port 8081 is only a default, deployments behind ingress controllers or with relabeled titles can evade the port and title-based searches. Scanner results also show what a service presents rather than whether it requires authentication, so matches cannot confirm access control. The main risk is job-level compromise, since an attacker who can submit a job can run code inside the cluster with access to its connected resources. Operators are advised to check their own public hosts for Flink fingerprints and verify whether the dashboard requires login.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Hybrid Humanity: How Cognitive Architecture Could Shape Freedom After AGI

The article explores a vision of Hybrid Humanity, in which AI-based cognitive augmentations serve as tools that expand genuine human agency. Drawing on the capability approach, the author argues that technology should enhance real human abilities rather than remain a privilege of elites. The author warns that a new divide could emerge between people using audited systems and those reliant on models shaped by corporate interests. To address this, the text proposes a polycentric network of intelligent institutions, termed Supersociety, that favors infrastructural pluralism over monolithic control. According to the author, cognitive freedom in a post-AGI world depends on open standards and the ability to switch augmentation providers, making competition policy central to that freedom.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Three CLI commands to run before shipping a side project: doctor, migrate, backup

The author argues that side projects often fail due to overlooked setup, migration, and backup gaps rather than weak ideas. They introduce Yatta JS, a backend-as-a-server for Bun that embeds database, auth, storage, and other services in the application process, available on npm as yatta.js. The post recommends running its doctor command to check project setup before every deploy, treating migrations as a routine repeatable workflow, and practicing backups and restores before they are needed. The author stresses that these tools do not replace careful judgment, and invites readers to share their own pre-launch habits.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Announces Lightweight FatafatOS 81 Update Claiming Minimal Hardware Needs

A developer named Karthik, who works under the handle Fatafat321 and is based in Elikatta, Telangana, India, has announced a major update to FatafatOS 81. The post claims the operating system runs on an old Intel i5 processor with low graphics and uses almost no RAM. It also states the system boots in about three seconds and has restored floppy disk support. The developer contrasts the project with heavier operating systems such as Windows, which he says requires 8GB of RAM, and invites users to share their PC specifications to see whether the system will run on them. The announcement is a self-published claim from a developer post and has not been independently verified.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Implementing API Key Authentication for REST APIs with Spring Security

A DEV Community guide explains how to add API key authentication to stateless REST APIs using Spring Security. It points out that the default session-based, form-login setup, with its CSRF tokens and cookies, is a poor fit for JSON endpoints consumed by internal tools, mobile apps, and partners. The recommended approach is a simple secret key sent in a request header, which is easier to generate, rotate, and audit than OAuth or JWT. The tutorial covers a custom authentication token and provider, a filter chain that extracts the key, and secure storage with hashing and rotation. It also addresses testing, common pitfalls such as leaking keys in logs, and production hardening like rate limiting, revocation, and monitoring.

0 comments Read more at DEV Community
Exposed Flink dashboards can enable job submission; search counts are not exposure estimates · ShortSingh