Coming from Enterprise Infrastructure World here, so take what I have to say in that context. This post focuses more on hard-coded credentials, which are absol

Coming from Enterprise Infrastructure World here, so take what I have to say in that context. This post focuses more on hard-coded credentials, which are absolutely a problem, but seemingly glosses over the difficulty of programmatic secrets management in an organization. Sure, GitHub secrets are perfectly functional…until they end up hard-coding themselves into your pipeline on accident, at which point you get to spend a lot of time and money setting up HashiCorp Vault or similar. That goes great until human error meets the complexity of modern security software and development best practices, at which point human error wins again. I would argue it’s not merely bad software from non-security companies, but also bad software calling from inside the house (said security companies). Bad agents that hoover up CPU cycles, feature overlap tangling themselves into knots with other programs, and products so complicated that nobody short of a mathematician and Cybersecurity expert could ever hope to comprehend what the various toggles and options are for, or whether it was deployed properly and securely. Over on Mastodon, I gave a shoutout to the ACME-bot team for actually meaningfully advancing the state of security by making PKI as easy as 1-2-3 for most deployments; this is the security model we should be championing if we want a more secure environment. We need to promote simplicity and security over complexity and legacy support, or we’re forever going to be chasing down human error.