3 ms·
I get this but then in practice the only actually valuable stuff on my computer is... the code and data in my dev containers. Everything else I can download off
by bandrami 1y ago
I get this but then in practice the only actually valuable stuff on my computer is... the code and data in my dev containers. Everything else I can download off the Internet for free at any time.
- ashishb 1y agoNo. Most valuable data on your system for a malware author is login cookies and saved auth tokens of various services.
- hinkley 1y agoMaybe keylogging for online services. But it is true that work and personal machines have different threat vectors.
- spicybright 1y agoYes, but I'm willing to bet most workers don't follow strict digital life hygiene and cross contaminate all the time.
- kolme 1y agoYou don't have any stored passwords? Any private keys in your `.ssh/`? DB credentials in some config files? And the list goes on and on.
- bandrami 1y agoI don't store passwords (that always struck me as defeating the purpose) and my SSH keys are encrypted.
- jamesnorden 1y agoThis kind of mentality, and "seems a bit excessive to sandbox a command that really just downloads arbitrary code", is why the JS ecosystem is so prone to credential theft. It's actually insane to read stuff like that said out loud.
- bandrami 1y agoRight but the opposite mentality winds up putting so much of the eggs in the basket of the container that it defeats a lot of the purpose of the container.