3 ms·
It assumes nothing like that. It provides you and your team with a safe opportunity to learn and grow. Revoking a key like this is a problem that's solution is
by loa_in_ 2y ago
It assumes nothing like that. It provides you and your team with a safe opportunity to learn and grow.
Revoking a key like this is a problem that's solution is at worst a dozen clicks away fix. The alternative, leaking keys can be much worse.
So go and reset those creds for the guy who made a mistake happily and be grateful. He had an opportunity to learn.
- rocqua 2y agoIt might be optimistic to say that rolling over to a new key is 'at most a dozen clicks'. Hardcoded keys are a big one. But even just hunting down all config where the key needs to change can be a major hassle. Is there some ci yaml that expects a runner to have the key in a .env file that only runs on major release? Good chance you won't realize that key exists. Still a great idea to revoke those keys. But it will damage some customers in the short term. And they will be angry, as people often are when you demonstrate their mistake.
- xyst 2y agoThere’s the guy that made _a_ mistake. Then there’s the guy who continues to make the same mistake over and over again. That second person is way to common in companies that hire from the bottom of the barrel.
- loa_in_ 2y agoThe thing with these kinds of mistakes is that if the service doesn't revoke the key and "cause problems" immediately, then there's no feedback to learn from. It's a fail-fast situation that's usually a better outcome anyway.