2 ms·
>* App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatic
by gruez 1y ago
>* App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatically kill the app if the token is ever breached.
How do you enforce the token actually exists? Do app developers have to hire some auditing firm to attest all their infra actually have the token available? Seems expensive.
- tonymet 1y agoit could be made available just to apple servers via ACL or protected token. but no one else .
- gruez 1y agoThat still doesn't make sense. How does the ACL work? What prevents the usual shenanigans like cloaking to prevent legitimate detection from working? Moreover what secrets are you even trying to detect? The app API token?
- tonymet 1y ago[flagged]
- gruez 1y agoI can't be constructive when your proposal is too vague to know how it works, I'm forced to take pot shots at what I think it is, and you getting upset because I'm not "constructive". Thoroughly explain how your plan works beyond the two sentences in your original post, and I can be "constructive".
- tonymet 1y ago[flagged]
- tonymet 1y ago[flagged]
- yjftsjthsd-h 1y agoIt's perfectly possible to point out a flaw without suggesting a replacement.
- tonymet 1y ago[flagged]
- yjftsjthsd-h 1y agoI disagree; if you suggest doing something, and someone points out a (legitimate) potential flaw/problem/shortcoming/difficulty, then that person has helped you and improved the conversation. Full stop. It might be nice if they can also suggest something better, but it's not necessary. It might even be in the final outcome that the original idea is still the best option, and even then it is preferable that its problems are known and hopefully considered for mitigation.
- tonymet 1y ago[flagged]