3 ms·
Given the build is from 2023 one would expect that at least the token would have been rotated, and I suspect some of these compliance checks do require rotation
by hmokiguess 1mo ago
Given the build is from 2023 one would expect that at least the token would have been rotated, and I suspect some of these compliance checks do require rotation of tokens/passwords.
That said, the whole compliance industry is a joke.
- icedchai 1mo agoBox checking is an important business!
- antonvs 1mo agoI can’t help noticing that an LLM can check boxes.
- fragmede 1mo agotokens yes, password rotation, no. In 2017: > NIST changed the guidance with SP 800-63B, published June 2017. It explicitly said: "Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)." Instead, passwords should be changed when there is evidence they have been compromised, not every 30/60/90 days.
- jacquesm 1mo agoI tried to open a conversation with an entity that issues ISO27001 certificates about the stuff I had found at a company they had recently certified. The response was such that I have lost faith in that entire industry. It's essentially a well dressed up pay-to-play.
- hmokiguess 1mo agoTotally, it's really a whole bunch of theatre to sustain an economy of leeches and middleman on your margins.