3 ms·
This has known for years now, but unfortunately, takes a long time to change. The other thing what I just read recently and mentioned in this article is about
by kissgyorgy 7y ago
This has known for years now, but unfortunately, takes a long time to change.
The other thing what I just read recently and mentioned in this article is about storing secrets in environment variables. That's not good either because every running code and subprocess can read it...
- noobermin 7y agoAs an ignorant person who doesn't do multiuser anything, how is this a problem if you are sure you're the only user of a physical system? The moment my computer is compromised by anyone else I'd think all bets are off then.
- sjy 7y agoI think the recent compromise at matrix.org [1] is a good example of how better defence in depth could have mitigated the damage done by an attacker who compromised a trusted machine. Specifically, access to a developer's SSH agent was the critical privilege escalation vector in this attack. [1] https://github.com/matrix-org/matrix.org/issues/371 https://github.com/matrix-org/matrix.org/issues/371
- kissgyorgy 7y agoA malicious third-party package (example: https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/ https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_st...) could read well-known environment variables like AWS credentials or something. I don't understand why we didn't heard about this kind of attack yet :D