• 1 Post
  • 176 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle












  • Depends. Our engineering slack (Few thousand members) doesn’t contain secrets for a few reasons:

    1. Secret scanning
    2. We have a /secret bot that will take your secret, store it securely, and then present a GUI for each person with access to display that secret “for just that person”. And then after a set period of time it’s made inaccessible, and wiped from the infra.
    3. Training and knowledge transfer on secret security

    This has been incredibly effective. Especially the secret bot.

    Turns out that the problem with people sharing secrets is just a matter of convenience. If you make a secure way convenient then everyone tends to just use it by default.





  • Yes but it pushes it to an operating system level and that means everyone wins as the operating system solutions to improve as vulnerabilities are found and resolved.

    You also don’t need rce access to exfiltrate data. If decrypted keys are held in memory, that mitigates an entire class of vulnerabilities from other applications causing your private chats from leaking.

    Full disk encryption is not a solution here. Any application that’s already running which can provide read only file system access to an attacker is not going to be affected by your full disk encryption.


  • They don’t necessarily need RCE access.

    Also this isn’t how security works. Please refer to the Swiss cheese model.

    Unless you can guarantee that every application ever installed on every computer will always be secure under every circumstances then you’re already breaking your security model.

    An application may expose a vulnerable web server which may allow read only file system access without exposing the user to any direct control of their computer from an attacker. Now your lack of security posture for your application (signal) now has a shared fate to any other application anyone else built.

    This is just one of many easy examples that are counter to your argument here.


  • This is exactly it. Reddit right now is what our society is like. This is the lowest common denominator.

    EVERY forum and community online will always approach the lowest common denominator as it’s size grows. This has always been the case on reddit, where niche communities lose their niche to the lowest common denominator.

    The only way to avoid this is active moderation, clear quality expectations, and a strong stance on what does and does not belong in a community.