3 ms·
This. It's the same reason full disclosure works; it forces people to do better.
by ahje 7y ago
This. It's the same reason full disclosure works; it forces people to do better.
- solidasparagus 7y agoIt doesn't feel like full disclosure is really the right policy here. It almost certainly makes more sense to give the person some time to clean up the secret before publicizing the secrets.
- akerl_ 7y agoAttackers can (and are) already pulling the same data sources that power this. Whether or not this site delays/obfuscates the exposed secrets, that doesn’t stop attackers.
- eitland 7y agoMany people feel full disclosure is never the right policy, and if we listened to them I'm afraid we would be worse off. It has done a lot of good though even though I prefer something like project zero where vendors a given some limited time before the information gets disclosed. As for this, I'm afraid one of the first results will be that the repo services shuts down the firehose access, which I think is bad. (I think I can see a number of other ways to improve the security that would work better than that.)
- solidasparagus 7y agoI should have clarified. I don't think immediate full disclosure is the right policy here. You should give people a chance to rotate the secrets before publicizing them. As the creator mentioned, most secrets are rotated quickly so it would be much more responsible to have this website run on a delay.
- eitland 7y agoIf you force this website to run on a delay some bad guy will just hack together his own. The cat is already out and information is contagious / wants to be free.