ejcx

18 ms·

121.
by ejcx 9y ago
Hey. I'll make sure to update the blog to include a shout-out to aws-vault! We were heavy users for the last few years. We are sometimes wary about contributing stuff like this upstream because it's not always accepted, and then w
122.
by ejcx 9y ago
AWS has a lot of resources that are not per region. The GDPR line is about improving our least privilege access story. There's a lot more to GDPR than that, though
123.
by ejcx 9y ago
We use ECR and have all of our images in our hub account, and make them readable from the prod/stage/dev accounts using a cross account policy. For S3, it's more complicated because of object permissions and all the insanity
124.
by ejcx 9y ago
Op here. I don't think you read the blog post! Our entire engineering org has a grand total of 0 AWS keys! Per-account isolation is great for security and especially reliability, if you run in to constant ratelimit issues like we do.
125.
by ejcx 9y ago
OP here. You _can_ do this but IAM Policy wise it is a mess and not very maintainable. You end up needing to constantly grant and revoke access to individual resources if you went this route. Instead, it's nice to give engineers access
126.
by ejcx 9y ago
I honestly don't know of the feature parity between the two, but we are definitely Okta power-users having added close to 500 apps in the last year. I don't know if we could drive all of the same processes we have built (especiall
127.
by ejcx 9y ago
Thanks for posting this here. I'm the author of this blog post. Feel free to ask me any questions you might have.
128.
Managing Secure Access to 100 AWS Accounts(segment.com)
3 points by ejcx 9y ago|0 comments
129.
by ejcx 9y ago
Just weird and a bad blog post. The author also wrote this: http://scripting.com/2018/02/23.html The owner is a domain parker and is upset that he has to update hundreds of sites in order to be marked as insecure,
130.
by ejcx 9y ago
Must be nice to be Quintin Clark. Showed up in Sept of 2017 and was awarded $34MM worth of stock according to this S-1. It looks like a healthy business. Congrats to dropbox.
131.
by ejcx 9y ago
Is email secure enough, or does Google/Microsoft running people's mail servers make it secure enough? I think it's the latter.
132.
by ejcx 9y ago
Resilient and secure compared to regular snail mail, you must mean. You're dangerously wrong about the security of email...
133.
by ejcx 9y ago
I hope email disappears. It has no security, bad tooling and software, weird protocols. Ip reputation has long been a thing in email. You can own IRC as well. I feel like your 3 cons are my three pros.
134.
by ejcx 9y ago
This should be renamed to "Telegram right to left vulnerability" This is just not an RCE. It's just pretty good phishing.
135.
by ejcx 9y ago
There are so many services with domain ownership validation issues. It's honestly an extremely hairy problem. Handling all the edge cases is extremely challenging to do so with good UX When a customer validates ownership do they keep i
136.
by ejcx 9y ago
Or with a different spin. Locking your computers that are no longer in company possession is a common Enterprise control. They take protecting your data seriously! If the authorities need the data on the computers the will surely present a
137.
by ejcx 9y ago
I've worked and had roles where I had a non-existent manager. If it is really really that bad, it's a much better outcome to leave amicably versus fighting to fix the issue. Remember that software is a very small industry we all w
138.
by ejcx 9y ago
If you have malicious applications running on your laptop you have bigger problems already...
139.
by ejcx 9y ago
Lots of people being critical of this response. I think it's pretty good, and have been on the disclosing side of this equation many times. Admits responsibility and says their current course of action (working with key stakeholders).
140.
by ejcx 9y ago
Segment | San Francisco, SF | Full-time | Onsite | https://segment.com/jobs Segment is growing quickly and hiring on all fronts. In the engineering organization, some roles I find particularly interesting: - Tooling E
141.
by ejcx 9y ago
Even if the data is not random it doesn't weaken your kernel prng by writing non-random data to urandom. Don't overcomplicate your threat model with non-existent risks
142.
by ejcx 9y ago
it expired >100 days ago. Im guessing people are supposed to go here: https://www.godaddy.com/help
143.
Show HN: NPR Lite(nprlite.org)
2 points by ejcx 9y ago|3 comments
144.
by ejcx 9y ago
I think this is a really weird situation. This 6year old did not make $11M. His parents did. His parents edit the videos, maintain high production value, market the channel, make a constant stream of videos starring Ryan. It's a pretty
145.
NPR Lite(nprlite.org)
4 points by ejcx 9y ago|0 comments
146.
by ejcx 9y ago
We wrote about our use of parameter store extensively. We have been very happy with it: https://segment.com/blog/the-right-way-to-manage-secrets/ I really think it's just an AWS account with credstash under t
147.
by ejcx 9y ago
You're assuming readers are managing snowflake servers, and I'm assuming they are in an containerized/autoscaling/more modern environment. SSM wins for mine. I think you're right that the file approach wins for your
148.
by ejcx 9y ago
While this is true, it's something you can work with in the future, and it defined a secrets process earlier rather than later If you do nothing you end up stuck with secrets in git history and you essentially have to roll them all. So
149.
by ejcx 9y ago
If you're all in on AWS, just use parameter store. This scheme is just CredStash, and so is parameter store under the hood.
150.
by ejcx 9y ago
You're right, but it's worse than you say. It's also legal data requirements. Many EU businesses ask that their data never leave Europe. How do you separate your product in to multiple continents and still work seamlessly. I

More ›