3 ms·
When you start doing security this way you end up chasing your tail. There are so many ways to mess it up. There is a really good article that explains a diffe
by colek42 5y ago
When you start doing security this way you end up chasing your tail. There are so many ways to mess it up.
There is a really good article that explains a different way of securing these systems though sets of attestations.
https://grepory.substack.com/p/der-softwareherkunft-software-provenance https://grepory.substack.com/p/der-softwareherkunft-software...
- staticassertion 5y agoStart doing security what way, exactly? I defined a threat model and a mitigation. And it's pretty straightforward - a single keypair that ties environment variables to their deployment. The article you linked to is about signing. It doesn't solve "I need to put an AWS key into the environment of a process".