mjg59

53 ms·

781.
by mjg59 5y ago
I, as your customer, don't control your expiration time. But I, as your customer, would like to be able to apply my choice of policy to tokens that you issue that grant someone access to my data, because otherwise I don't contro
782.
by mjg59 5y ago
You're free to assert that it's not your issue to solve, and I'm free to assert that I'm not using your service as a result. It is possible to provide equivalent functionality without it being trivial to exfiltrate authe
783.
by mjg59 5y ago
Or we could invent better solutions where we didn't need to depend on policies imposed by vendors? The value that Github provides isn't around their git hosting, it's all the integrated features. Reimplementing that isn'
784.
by mjg59 5y ago
There's no universe where a typical tiny customer is going to be able to impose policy on a large vendor, and there's just not that many vendors in this space. So, yes, I could go with "We're not going to use Github or G
785.
by mjg59 5y ago
I'm not aware of any web APIs for secure key storage. That feels like something that would be of value, but coming up with a way to attest to the key being hardware-backed is hard to do without privacy impact - you need some sort of in
786.
by mjg59 5y ago
I control my laptops. I control the policy for my identity provider. The service that hosts my source code is a third party, and defines their own policy which may not match mine.
787.
by mjg59 5y ago
And if I compromise a system that possesses one of those JWTs, I can copy it elsewhere and have access to all the resources that JWT grants me access to. You're not tying it to a specific device, and you're not providing a mechani
788.
by mjg59 5y ago
No, I'm worried that if someone has temporary access to a machine that has one of these long-lived tokens, they may continue to have access to anything that that long-lived token grants access to.
789.
by mjg59 5y ago
Mutual certs get you closer, but the missing component is device state validation. I probably don't want to share my understanding of device state with a third party (it might include things like which apps are installed on a device, a
790.
by mjg59 5y ago
You're a 5-person startup. How do you verify that all of Github's token issuance policies align with your needs?
791.
by mjg59 5y ago
I, as the company paying for your service, have no direct ability to influence the policy that you apply to the tokens you issue. If you start issuing tokens that are good for decades, I have no trivial mechanism to detect that.
792.
by mjg59 5y ago
Hypothetical: I have a Github Enterprise org. Users log in via my identity provider to gain access. Github then issues a long-lived oauth token to the Github Desktop app. An attacker compromises a user's laptop and copies that oauth to
793.
by mjg59 5y ago
If someone's in a position to exfiltrate the JWT, they're almost certainly in a position to extract all the information they'd need to reproduce the fingerprint. It'd be a short term strategy until attacker tooling caugh
794.
by mjg59 5y ago
The problem is that you don't have control over what third parties are doing here. You may have control over the policies associated with tokens issued by your identity provider, but how do you audit the policies that third party servi
795.
by mjg59 5y ago
Device info is spoofable, and tying it to IP means the phone experience is just awful.
796.
by mjg59 5y ago
I wrote https://mjg59.user.srcf.net/entropy/ over 20 years ago, so yes, this is an entirely solved problem. (The issues associated with seeding an RNG with data entirely controlled by a third party are left as an exerc
797.
by mjg59 5y ago
It contains bootloaders.
798.
by mjg59 5y ago
Can you point at a machine like this? Literally every machine I've worked with has UEFI entirely implemented in motherboard flash.
799.
by mjg59 5y ago
A few thoughts: yes, UEFI is a large attack surface. Secure Boot mitigates a lot of that - if it's turned on, the vast majority of UEFI functionality is only accessible to signed binaries. If you're running untrustworthy code in y
800.
by mjg59 5y ago
> Something has to start reach and load the UEFI written on a 'boot media' No. The UEFI stack lives entirely in flash, the same as BIOS did.
801.
by mjg59 5y ago
I used to work at 24th and had no problem getting a seat in peak hours - the majority of the people taking BART eastbound across the bay are getting on at downtown stations. Given existing infrastructure, it would be literally impossible to
802.
by mjg59 5y ago
It's not just a marketing problem! With three minute headway, you can turn up a train that can carry up to ~2000 people (under BART's definition of crush load) and have another train there three minutes later. The largest AC Trans
803.
by mjg59 5y ago
Pre-COVID, AC transit moved a total of about 50% as many people across the bay per day as BART did in a single peak hour. The bus may well meet your specific requirements, but it's pretty clear that that's not the case in general.
804.
by mjg59 5y ago
There are two scenarios where carrying out their threat plausibly helps the open source community: 1) A source drop demonstrates that Nvidia incorporated GPLed code into their drivers. This is, honestly, unlikely - Nvidia has sufficiently c
805.
by mjg59 5y ago
Simultaneously arguing that Flatpak isn't the future because it relies on runtimes that may duplicate resources, and then suggesting that you should statically link in all your dependencies (creating far more duplication than Flatpak r
806.
by mjg59 5y ago
Related discussion in which I make it extremely clear that there's no meaningful evidence to support this assertion, and that Pluton doesn't change the status quo compared to basically every system being sold today having a TPM an
807.
by mjg59 5y ago
I've seen literally zero evidence that the assertion that Pluton will prevent you running modified software is true.
808.
by mjg59 5y ago
Oh absolutely - as far as the code is concerned they're just bytes, the fact that interpreting them as UTF-8 is entertaining is not something the kernel cares about at all.
809.
by mjg59 5y ago
Although the fact that I've since encoded the "UUID" that this is contained within into other codebases such that Linux can't remove it without breaking some deployed u-boot builds is definitely something I'm proud
810.
by mjg59 5y ago
I can only aspire to this level of beautiful whimsy - it's unfortunate that it triggered a codepath that could be measured, because that is by far the easiest excuse to remove something beautiful and rarely seen. The closest I've

More ›