30 ms·

> Because this has been the case forever with all security and SIEM tools. Why? There is no need to send your environment variables.

• gruez 2y ago
  Otherwise malware can hide in environment variables
  • llm_trw 2y ago
    Ok, suppose you're right. Why are they only doing it for macs then?
    • batch12 2y ago
      I don't think this is limited to just Macs based on my experience with the tool. It also sends command line arguments for processes which sometimes contain secrets. The client can see everything and run commands on the endpoints. What isn't sent automatically can be collected for review as needed.
      • st3fan 2y ago
        It does redact secrets passed as command line arguments. This is what makes it so inconsistent. It does recognize a GitHub token as an argument and blanks it out before sending it. But then it doesn’t do that if the GitHub token appears in an env var.
    • st3fan 2y ago
      It may depend a bit on your organization but I bet most folks using an EDR solution can tell you that Macs are probably very low on the list when it comes to malware. You can guess which OS you will spend time on every day ...
      • llm_trw 2y ago
        So because macs are not the targets of malware ... we're locking them down tighter than any other system?
        • namaria 2y ago
          No, see, they're leveling the playing field by storing all secrets they find on macs in plaintext
  • worik 2y ago
    They do not need to take the data off the computer to do that
  • cma 2y ago
    Malware can hide in the frame buffer at modern resolutions. They could keep a full copy of it and each frame transition too.