kubernetes
2 posts · all writing
A misconfiguration has no CVSS, which is why nobody fixes it
A privileged pod and a public bucket have no CVE and no CVSS, so every IaC tool invents a severity and the breach sorts below an unreachable dependency.
CIS benchmarks are somebody else's checklist
A benchmark flags things you chose deliberately. The value is not the score, it is the short list you decided not to meet and the record of who decided.