On: Kubescape – tool for testing if Kubernetes is deployed securely

[anotherhue]

> An attacker who tries to serve different things to different people will easily be caught

Can be detected, and will be detected are quite different. I don't know of any scanning projects even attempting to detect such things.

[kentonv → anotherhue]

It's easy enough to detect that no smart attacker would go this route and risk creating very clear evidence that could send them to jail.

Creating a subtle, plausibly-accidental bug and then exploiting it is much safer.