3 ms·
People don't need an extra supply-chain failure mode to consider, and CVE proved these dongles are mostly security theater. Likewise, the recent Coinkite user
by Joel_Mckay 2mo ago
People don't need an extra supply-chain failure mode to consider, and CVE proved these dongles are mostly security theater. Likewise, the recent Coinkite user key prediction breach certainly wasn't cool for folks that lost their holdings. =3
- Antirust3743 2mo agoWrong cve and a side channel attack doesn't mean these dongles are useless. It would have stopped the firefox team's ai from commiting their subkey ;)
- eptcyka 2mo agoStoring the secret on a hardware token will most certainly help with not committing into source control.
- Joel_Mckay 2mo agoMost use another build host siloed from the dev staging area, regression tested/audited, and with limited administrative access. =3
- eptcyka 2mo agoYe, and how do you get source code from devs into that silo?
- Joel_Mckay 2mo agoUsually set up a custom build-bot that pulled a named branch into a VM with a read-only backing image. Had to be done that way for a number of reasons, but mainly simplified dealing with fussy fragile cross-platform build/test environments. I should also add even simple visgrep and xdotool can automate a lot of checks that normally takes hours of repetitive testing. Best of luck =3
- perching_aix 2mo ago> these dongles are mostly security theater ...as opposed to? What's your criteria for "non-security-theater"?
- Joel_Mckay 2mo agoSiloed functional regression test verification, structural audits, and package signing. Probably would conclude dev staging areas can't run continuous integration with the current design team. Asking them to take on additional tasks while they already are YOLO'ing it with an LLM is a suckers bet. =3