4 ms·
"Secret filtering" is buggy, broken, stupid, misleading, and just plain wrong anyway. 1) If you can cause it to be run on arbitrary code then you can cause it
by jfrunyon 6y ago
"Secret filtering" is buggy, broken, stupid, misleading, and just plain wrong anyway.
1) If you can cause it to be run on arbitrary code then you can cause it to reveal the secret. Even if the only output you see is a pass or fail.
2) If you can't cause it to be run on arbitrary code, then why do you need to see any output?
- dessant 6y agoUnexpected behavior caused by any bug could print the variable to the build log, there is no need for malicious code to end up with compromised secrets.
- koolba 6y agoMalicious code could also print the ROT13, hex, base64, or even selectively fail tests so that every failure is a bit of entropy. Filtering secrets from logs only protects accidentally dumping your environment to a log Because you left in an echo $SECRET. It doesn’t stop a determined attacker who can run arbitrary code.
- Shish2k 6y agoIf a feature protects against accidents, why should “but a determined attacker can work around it” stop one from using that feature?
- dessant 6y agoMasking secrets is not meant to defend against malicious code, but mitigates a class of issues in the build system and the software you build that could lead to inadvertently leaking secrets.