3 ms·
I hate to be that guy but this news highlights some blatantly incompetent security protocols (especially key management) by a company that we should expect bett
by jay-barronville 4y ago
I hate to be that guy but this news highlights some blatantly incompetent security protocols (especially key management) by a company that we should expect better from. Even something as simple as a Vault (HashiCorp) cluster with decentralized key shares would’ve prevented this. I’m really disappointed in CircleCI. There’s no way I’d trust them after this.
- akdor1154 4y agoWould it? A vault token could be stolen in the same way.
- komuW 4y agoNote that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-221625921 https://github.com/hashicorp/vault/issues/1446#issuecomment-...