3 ms·
Malicious code could also print the ROT13, hex, base64, or even selectively fail tests so that every failure is a bit of entropy. Filtering secrets from logs o
by koolba 6y ago
Malicious code could also print the ROT13, hex, base64, or even selectively fail tests so that every failure is a bit of entropy.
Filtering secrets from logs only protects accidentally dumping your environment to a log Because you left in an echo $SECRET. It doesn’t stop a determined attacker who can run arbitrary code.
- Shish2k 6y agoIf a feature protects against accidents, why should “but a determined attacker can work around it” stop one from using that feature?
- dessant 6y agoMasking secrets is not meant to defend against malicious code, but mitigates a class of issues in the build system and the software you build that could lead to inadvertently leaking secrets.