- Видео 35
- Просмотров 44 341
Andrew Hoog
США
Добавлен 25 авг 2022
Technical videos covering cybersecurity, privacy, forensics, DevSecOps and probably some Final Cut Pro X and other topics of interest to me. :-)
Background: I’m a computer scientist, mobile security and forensics researcher, and co-founder of NowSecure. I’m also a testifying expert witness, author of two books on mobile forensics for Android and iOS, and hold three patents in the areas of forensics, security and data recovery.
Background: I’m a computer scientist, mobile security and forensics researcher, and co-founder of NowSecure. I’m also a testifying expert witness, author of two books on mobile forensics for Android and iOS, and hold three patents in the areas of forensics, security and data recovery.
How to customize nginx config in docker image
Technical blog: www.andrewhoog.com/post/how-to-customize-nginx-config-in-a-docker-image/
When hosting websites with docker (and proxying via Caddy), I often need to tweak the nginx config. This how-to guide will walk you through the steps you can take to accomplish this.
00:00 - Intro
00:16 - Prerequisites / assumptions
00:46 - Build and run docker image locally
01:43 - nginx 405 error when POST’ing to static page
02:12 - shell into running docker container
03:46 - nginx config in nginx-alpine image
04:43 - docker cp command
05:37 - modify nginx default.conf locally
06:07 - copy customized nginx config into docker image
06:37 - wrap up
#docker #nginx #devops
When hosting websites with docker (and proxying via Caddy), I often need to tweak the nginx config. This how-to guide will walk you through the steps you can take to accomplish this.
00:00 - Intro
00:16 - Prerequisites / assumptions
00:46 - Build and run docker image locally
01:43 - nginx 405 error when POST’ing to static page
02:12 - shell into running docker container
03:46 - nginx config in nginx-alpine image
04:43 - docker cp command
05:37 - modify nginx default.conf locally
06:07 - copy customized nginx config into docker image
06:37 - wrap up
#docker #nginx #devops
Просмотров: 1 309
Видео
Overview and analysis of SEC's new Cybersecurity Disclosure rules - SnowFROC 2024
Просмотров 1518 месяцев назад
Blog: www.board-cybersecurity.com/blog/2024-03-13-impact-of-new-sec-cybersecurity-rules-snowfroc-2024/ Re-recording of my SnowFROC 2024 presentation about the new SEC cybersecurity disclosure rules including an overview of the rules, analysis of disclosure to date and best practices for filing 8-K and 10-K cybersecurity disclosures. #sec #cybersecurity #8k #10k 00:00 - Introduction 01:33 - Why ...
Building a simple HN reader for iOS with GitHub Copilot - Part 7: Reimport previous code
Просмотров 194Год назад
Technical blog: www.andrewhoog.com/post/building-a-simple-hn-reader-for-ios-with-github-copilot-part-7-reimport-code/ 00:00 - Intro - Reimport previous code 00:29 - Using GitHub Copilot Chat for help on git branches 01:11 - Create and checkout a new git branch 02:08 - Copy previous code over 02:36 - Add missing Views 03:38 - Create Story model 05:19 - StoriesModelView 07:36 - Install Firebase S...
Building a simple HN reader for iOS with GitHub Copilot - Part 6: Configure GitHub Actions
Просмотров 50Год назад
Technical blog: 00:00 - Part 6 intro 00:10 - GitHub Actions plan for automated build and security scans 01:58 - GitHub Action to build and scan iOS app - static only 02:34 - Use GitHub Copilot to help write a GitHub Action 04:23 - Dynamic security scans on pull requests or new releases 09:54 - Thoughts on GitHub Copilot X results for GitHub Actions How to build an iOS app with GitHub actions - ...
Building a simple HN reader for iOS with GitHub Copilot - Part 5: GitHub repo setup
Просмотров 73Год назад
Technical blog: www.andrewhoog.com/post/building-a-simple-hn-reader-for-ios-with-github-copilot-part-5/ 00:00 - Intro - Part 5 00:56 - How to use Copilot, VSCode and Xcode together 01:27 - Create new GitHub repo 02:22 - Create new Xcode iOS app project 03:55 - Commit new project to repo using VSCode terminal :::::::::::::::::::: Music: Fire - Elektronomia Video: www.youtube.com/watch?v=mX-Sk......
Building a simple HN reader for iOS with GitHub Copilot - Part 4: Developer Housekeeping
Просмотров 79Год назад
Technical blog: www.andrewhoog.com/post/building-a-simple-hn-reader-for-ios-with-github-copilot-part-4/ In the series, I will build a simple Hacker News reader for iOS using Firebase, SwiftUI and GitHub Copilot. In part 4, I use GitHub Copilot X to tackle the following developer housekeeping tasks: - Add Swift LSP support in VSCode - Enable vim bindings in VSCode - How to run a terminal in VSCo...
Building a simple HN reader for iOS with GitHub Copilot - Part 3: @ObservedObject & Refactoring
Просмотров 66Год назад
Technical blog: www.andrewhoog.com/post/building-a-simple-hn-reader-for-ios-with-github-copilot-part-3/ In the series, I will build a simple Hacker News reader for iOS using Firebase, SwiftUI and GitHub Copilot. In part 3, I use GitHub Copilot X to tackle the following: - Automatically update NewsView from TopStoriesModelView - Incorrect prompts for Firestore rabbit hole - Successfully connect ...
Building a simple HN reader for iOS with GitHub Copilot - Part 2: Models, ModelViews and Firestore
Просмотров 79Год назад
Technical blog: www.andrewhoog.com/post/building-a-simple-hn-reader-for-ios-with-github-copilot-part-2/ In the series, I will build a simple Hacker News reader for iOS using Firebase, SwiftUI and GitHub Copilot X. In part 2, I use GitHub Copilot X to tackle the following: - Model files for Stories and TopStories - Code for TopStoriesModelView - Use Copilot Chat to resolve "Cannot find Firestore...
GitHub Copilot X for iOS - building a simple Hacker News reader from scratch - Part 1
Просмотров 179Год назад
Technical blog: www.andrewhoog.com/post/github-copliot-x-for-ios-building-a-simple-hacker-news-reader-from-scratch-part-1/ Join my Mobile DevSecOps Discord server to continue the discussion: discord.gg/mMKPG4Ks In this series, I will build a simple Hacker News reader for iOS using Firebase, SwiftUI and GitHub Copilot X. In this first session, I tackle the following: - Setup and configure VSCode...
GitHub Copilot for iOS - first experience rebuilding a simple open source iOS app
Просмотров 6 тыс.Год назад
Technical blog: www.andrewhoog.com/post/github-copliot-for-ios-rebuilding-a-simple-ios-app/ I built a simple iOS app using GitHub Copilot and based on Angela Yu's excellent iOS & Swift Bootcamp on Udemy (Section 17). This post is hopefully the first of many sharing my experience with GitHub Copilot and LLM technologies in general. This initial look examines how to using GitHub Copilot with Xcod...
Authorizing GitHub Container Registry
Просмотров 587Год назад
Technical blog: www.andrewhoog.com/post/authorizing-github-container-registry/ If you ever get unauthorized error messages from `docker-compose pull` or `docker login`, this is likely due to an (mis|un)configured or expired GitHub Packages token. This video will quickly walk you through the steps to resolve this error. 00:00 - Intro 00:44 - Docker unauthorized errors 01:42 - (Re)generate a GitH...
Mobile Security & Privacy Weekly Digest - 2023.10
Просмотров 53Год назад
Your weekly digest of Mobile Security and Privacy News in under 9 minutes! Each digest will cover the past week of briefings so you can quickly catch up on all the important topics in mobile security and privacy. Blog: www.andrewhoog.com/post/mobile-security-and-privacy-weekly-digest-2023.10/ If you have any topics you’d like me to cover in the future, just drop me a comment in the RUclips vide...
How to build an iOS app with GitHub Actions [2023]
Просмотров 19 тыс.Год назад
Technical blog: www.andrewhoog.com/post/how-to-build-an-ios-app-with-github-actions-2023/ In this video, I'll walk you through how to build an iOS app with GitHub Actions (no 3rd party actions needed!). When I first embarked on this technical how to, I have to admit it was pretty overwhelming. But along the way, I stumbled across an excellent document from GitHub that all the difference. Combin...
Mobile Security and Privacy Weekly Digest - 2023.09
Просмотров 84Год назад
Blog: www.andrewhoog.com/post/mobile-security-and-privacy-weekly-digest-2023.09/ Your weekly digest of Mobile Security and Privacy News in under 8 minutes (shoot, 17 mins this week, sorry)! Each digest will cover the past week of briefings so you can quickly catch up on all the important topics in mobile security and privacy. If you have any topics you’d like me to cover in the future, just dro...
Unofficial ChatGPT mobile apps pose privacy risk - Mobile Privacy Briefing 2023.095
Просмотров 28Год назад
Unofficial ChatGPT mobile apps pose privacy risk - Mobile Privacy Briefing 2023.095
SBOM analysis of 10 popular Android sports/betting apps by Synopsys CyRC - Mobile Security Briefing
Просмотров 76Год назад
SBOM analysis of 10 popular Android sports/betting apps by Synopsys CyRC - Mobile Security Briefing
Vulnerabilities in Hyundai & Genesis mobile apps allow full remote vehicle access & account takeover
Просмотров 68Год назад
Vulnerabilities in Hyundai & Genesis mobile apps allow full remote vehicle access & account takeover
DoD IG report on mobile apps uncovers serious ops & cyber risks - Mobile Security Briefing 2023.092
Просмотров 50Год назад
DoD IG report on mobile apps uncovers serious ops & cyber risks - Mobile Security Briefing 2023.092
NSA Mobile Device Best Practices - Mobile Security Briefing 2023.091
Просмотров 217Год назад
NSA Mobile Device Best Practices - Mobile Security Briefing 2023.091
Mobile Security & Privacy Weekly Digest - 2023.08
Просмотров 39Год назад
Mobile Security & Privacy Weekly Digest - 2023.08
3 ways to install Java on macOS [2023]
Просмотров 4,3 тыс.Год назад
3 ways to install Java on macOS [2023]
TikTok privacy insights via reverse engineering - Mobile Privacy Briefing 2023.084
Просмотров 786Год назад
TikTok privacy insights via reverse engineering - Mobile Privacy Briefing 2023.084
Scandinavian Airlines mobile app cyberattack - Mobile Security Briefing 2023.083
Просмотров 29Год назад
Scandinavian Airlines mobile app cyberattack - Mobile Security Briefing 2023.083
Actively exploited WebKit flaw patched in iOS 16.3.1 - Mobile Security Briefing 2023.082
Просмотров 91Год назад
Actively exploited WebKit flaw patched in iOS 16.3.1 - Mobile Security Briefing 2023.082
Mobile app privacy enforcement push from CA Attorney General - Mobile Privacy Briefing 2023.081
Просмотров 40Год назад
Mobile app privacy enforcement push from CA Attorney General - Mobile Privacy Briefing 2023.081
How to build a React Native Android app with GitHub Actions
Просмотров 5 тыс.Год назад
How to build a React Native Android app with GitHub Actions
How to detect Pushwoosh hidden Russian software in your mobile supply chain
Просмотров 3602 года назад
How to detect Pushwoosh hidden Russian software in your mobile supply chain
Use Github Actions to generate an Android SBOM every time you build your app
Просмотров 4982 года назад
Use Github Actions to generate an Android SBOM every time you build your app
How to detect OpenSSL v3.0 and Heartbleed vulnerabilities in mobile apps
Просмотров 3352 года назад
How to detect OpenSSL v3.0 and Heartbleed vulnerabilities in mobile apps
I don't have any config folder unfortunately. Followed the quickstart from the CLI and still have the same error on a brand new repo after these steps: 1) hugo new site hugo-blog 2) hugo new theme hugo-theme 3) edited hugo.toml and specified theme = 'hugo-theme' 4) tried to create new content with a) hugo new content posts/my-first-post.md b) hugo new content content/posts/my-first-post.md Still get that error. Highly frustrating to say the least.
wow so simple and easy to grasp concept.
Thanks this helped me out!
This was useful and well explained, thanks
what about ios? any doc will be helpful please.
Doesn't work in 2024. xcode no longer has plist files.
I have watched a number of SBOM videos like yours but seems like all the options are overly complicated to create a SBOM of a source or binary folder which uses gcc to compile it (i.e. pretty common for me). You have a simple root folder with a program_name.c and it has a number of includes. After compile you have an executable. I used the following against the executable on the mac but it does not show any dependancies. Real Example: I downloaded the source code for gzip. "Exactly" how would I scan that source code folder to get a SBOM showing that it uses a version of ZLIB? Of course they do not provide a SBOM. From what I can tell no one does. What am I missing? Does anyone actually do this? Here is the binary scan command I ran on my mac. ./cyclonedx add files --no-input --output-format json --base-path binary --output-file sbom.json Processing base path /Users/mike/z-cyclonedx/binary/. I put the compiled binary in the binary folder. I do get a SBOM but I think it is useless. One of your other videos uses a program I think you wrote. It would be nice if this could be as simple as scanning a binary like scanning for a virus which has been done for how many years?
Nice video. Can you also make a video on pods with github action?
Thank you, your tutorial has helped me a lot. 👍
thanks you saved my day, i was struggling with this
Thankyou!!! What a bloody effort this was, so involved. I learnt a lot though, thankyou. Terminal took a while to download everything what was needed. I had errors ib copying the code because I added the parenthesis and couple other matters. Chat GPT helped here.
Always getting "Xcode couldn't find any iOS App Development provisioning profiles matching ..." UNLESS I give the original name to my_pp.mobileprovision when copying it into the github action. Was your provisioning profile named build_pp ?
Quite an interesting tool you have here. Especially the capability to do a quick scan of the SBOM.
Thx! As a developer, I really do like the quick static analysis that includes transitive dependencies for mobile apps
Really nice overview of what can and cannot be done with source code and binary analysis. And yes, you are completely right at the end of your video, that the combination of the two is the best approach. However, I am not aware of any tool that could do both... at least not today. Great stuff, thank you
Agreed, today I think you have to stitch things together. At NowSecure, we haven’t seen enough demand to prioritize this over other tools, but with our iOS, SDK for security telemetry, we can actually get a source SBOM and then combine that with the static analysis bomb, including transitive dependencies.
Many thanks for this - made an overwhelming task seem much more approachable.
It was really usefull to me, Thank you
Love it. Thanks for sharing!
Is it possible to post the ipa automatically to the App Store not downloading and uploading it manually?
Yes you can upload an ipa automatically to the App Store
hey Andrew, I get this error, with no additional information. where should i dig into? Process completed with exit code 65.
same here
helpful
This video is super helpful, I managed to get the app archived and exported in the command line of my mac no issues. When I setup in github actions though at the export step I get an error that there is no Distribution certificate. I know the cert installed in the secrets is a Development certificate, but that seems to be all I needed on my mac. Any ideas what I could be doing wrong?
Xcode cloud simplifies this process greatly. Wondering what you think about GH actions vs Xcode cloud?
cause it's too expensive
Dear Andrew, Thanks for sharing your knowledge. You are making wonderful videos. I have a question, definitely you will have an answer for this. We have tools called blackduckhub and veeracode they are for SCA. How does this sbom is different from those tools, and is it required if we are already using those tools. Can SBOM be generated for docker image too ? Sorry if my question sounds silly. Hoping for your response
Thank you that was super helpful for me , I'm facing issue for the provisioning profiles I have multiple profiles , I'm facing issue in the app groups with the automatic singing , any recommendations ?
/Users/runner/../app.xcodeproj: error: No profiles for 'com.app.NotificationService' were found: Xcode couldn't find any iOS App Development provisioning profiles matching 'com.app.NotificationService'. Automatic signing is disabled and unable to generate a profile. To enable automatic signing, pass -allowProvisioningUpdates to xcodebuild. (in target 'NotificationService' from project 'app')
I do! I ran into the same issue and here are detailed steps and links to my code that will handle multiple provisioning profiles. www.andrewhoog.com/post/how-to-build-react-native-ios-app-with-github-actions-2023/#31-bundling-multiple-mobile-provisioning-profiles
Most simple and elegant explanations! Thank you!
Glad it was helpful!
This is so frustrating as my .mobileprovision file is too big to save into a secret. Is there a way NOT to save the .mobileprovision into a secret?
Nice video! I’m having a problem tho. I’m getting exit code 66, that the directory does not contain an Xcode project. How can I manipulate that path to fix that?
Is the repo public? I’d be great to have a look at that, or perhaps some more of the error log. If it’s not public, maybe just post the error log and file list in a gist and share the link here?
The repo is not public, but I already fixed that issue! Thanks. I’m having a problem with the Provisioning profiles, do you know a way of seeing the Logs of a Build with xCode to see the correct ones that I should use?
Great, the mobile provisioning profiles can be tricky, especially if you have more than one. I have a video that talks through how to handle that as well as a public repo with example code. To see the Xcode logs, I use the xcodebuild command. I Reference it in several videos, and you could run that on your workstation or in the kid have action, which would then be accessible in the action logs. Here’s a link to a video that talks about how to run Xcode command line: www.andrewhoog.com/post/how-to-build-an-ios-app-archive-via-command-line/
Yea i saw that link! but i quitted because i had a lot of errors trying to build the project via xcodebuild command. Thats why i still can't see the Logs, and figure out what should be the correct Mobile provisioning Profiles and certificates@@SPFExpert. The error that i have using xcodebuild command is: fatal error: module map file '/Users/pablo/Library/Developer/Xcode/DerivedData/Glik-bxbwmzcivjasbkbiqxqkmjmbxeli/Build/Products/Debug-iphoneos/FirebaseCoreInternal/FirebaseCoreInternal.modulemap' not found And in my Github Action, i'm having the next error: error: Signing certificate is invalid. Signing certificate "Apple Development: Pablo Alvarez Sanhueza (5T8495ARD9)", serial number "5559B7A3CA5E2DB37D26C57053EBBD43", is not valid for code signing. It may have been revoked or expired. (in target 'Glik' from project 'Glik') But i can build my app locally using that certificate in my laptop. That is my issue right now :( thank you so much for replying Andrew
How are you adding fire Bace? It’s likely that before you try to build the app, command line or we could have actions, you’ll need to first run the command to install third-party packages. Are you using Swift Package Manager (SPM)? P.S. you might want to check out this flag as I use it in a simple Hacker News reader I wrote. This build script works but I don’t remember where/how the dependencies are installed. I’m suing SPM. github.com/ahoog42/simple-hn-reader/blob/main/.github/workflows/full-scan-on-pr-and-release.yml#L75
Dude you are a geek
I'm in love with this man. Definitely subscribe. 😽
Thx, I’m glad you found the video helpful. Thanks for the support!
Thank you! You gained one more Subscriber.
Thx, I appreciate it! :-D
That was so helpful, to me, thank you. Thanks to your video I could set up the certs and passwords needed I managed to set up a a Github workflow, running on mac, that tuns a Qt Creator build with signing and upload the .dmg file as an artifact Super thanks
That’s so great to hear! Exactly the reason I like to share these videos.
How you installed copilot for your Xcode? Do you have another video for it?
Right now, there isn't a native Copilot agent for Xcode. You can check out this extension that others have used: github.com/intitni/CopilotForXcode Behind the scenes, it uses the some lsp that neovim does. But I heard the user experience isn't great so I instead added Copilot to VSCode and then flipped between the two IDEs as needed. HTH.
This is THE guide on how to install Java on Mac. Helped me out a lot as, I'm new to Mac, and used brew but didn't run the symlink command afterwards and wasn't sure what was wrong. Thanks Andrew!
Thx so much, glad it was helpful! I too glossed over the symlink stuff so wanted to document is after I took a closer look.
i saved some time this morning because of you! Thanks
That’s awesome. Many of my blogs and videos started out as “notes to self” but in case it might help others, I wanted share. Glad it did!
This was super helpful 🔥
Yay, thx!
Great content! Congrats and thank you Andrew!
Awesome! Thanks Andrew!
Really nice video. Good luck with your youtube endeavors. 👍
Thx!
I like your style! You provided all the details and did some hands on stuff, while also explaining the high level concepts! Very rare in youtube :)
Thx so much for the feedback Nicolas! I really enjoy sharing the technical how to videos and appreciate the positive feedback. :-)
Great video 🤗 Can't wait for ios tutorial you've mentioned!
Getting closer! I’ll post a comment here to the link when the video is done. Thanks!
Hey Piotr, I don't have a video yet but here's a step-by-step tutorial on building a RN iOS app with GitHub Actions: www.andrewhoog.com/post/how-to-build-react-native-ios-app-with-github-actions-2023/
Love the way u explain !! Great tutorial
Thx, appreciate the feedback!
Drop it !