4 ms·
It's all the more pathetic that they responded to the first hack by "obfuscating" the client-side secret, as if that could even theoretically stop any attacker
by sowbug 9y ago
It's all the more pathetic that they responded to the first hack by "obfuscating" the client-side secret, as if that could even theoretically stop any attacker with a budget of more than about an hour.
Future service designers: if your client is talking directly to AWS, then your attacker will, too. Take the week to write a CRUD frontend server that enforces the policy you want.
- figgis 9y agoDo you have a recommended security checklist for something like this? I remember seeing an old github repo with a bunch of good information but I cannot seem to find it and my search results are... unhelpful at best.
- neuland 9y agoChecklists are cool and all. But, you shouldn't need a checklist to know that you shouldn't ship API keys.
- figgis 9y agoCan't disagree with that.
- petee 9y agoCheck out OWASP cheatsheets and guides: https://www.owasp.org/ https://www.owasp.org/
- tachion 9y agoYou wont like it, but... How would you feel being asked for a checklist for 'good software development' or something similar by a cooking chef? Hire skilled and dedicated DevOps/SRE/SysAdmin/hype-of-the-week person. ;)
- tachyoff 9y ago100% this. I’ve been transitioning to doing more devops/admin work for the past several months and it’s amazing the stuff people are willing to put into production. Like no, maybe we shouldn’t be committing that secret to Github. Dedicated operations critters are essential for any kind of service.
- figgis 9y agoA chef cooking something unfamiliar will look up the dish they are cooking. If your cookbook can't handle a checklist of common pitfalls and overlooked actions to take then it isn't much of a cookbook. (granted not putting your secrets in a public repo is definitely a given.)