Viewing profile — kkl

SSH CAs are not incompatible with my argument! An SSH CA can sign short-lived certificates for just-in-time generated keys.

> "we can't have service accounts" To be clear: This is not my position! I advocate for service accounts in my post: > It is much harder to reason about, say, the security of an ar…

Part of the threat model for an Engineering team is that people come and go. They move teams which have different levels of access. They leave the organization, in most cases, on g…

> "Had the engineer that acted on that known better, or did other checks, this would have been avoided." takes long drag tweet[1] here> I personally find "LLMs can do $THING poorly…

> The job of a code reviewer isn't to review code. It's to figure out how to obsolete their code review comment, that whole class of comment, in all future cases, until you don't n…

It’s also the case that someone you trust makes an honest mistake and, for example, gets their laptop stolen and their credentials compromised. I do trust my team, and want that to…

Congratulations! Fish is such a wonderful shell. It’s been my daily driver for many years now but I’ve had a renewed appreciation for it now that I’m working in several different d…

I could also buy that the free domains were ran up by scammers which could have caused some of the hair trigger Safe Browsing denylisting.

While there are compliance/security benefits it is not the primary motivation. If you have fairly complicated infrastructure it can be way more efficient to have a pool of ready to…

Losing control of your actual phone is not the same as losing control of your phone number. I'm not sure about Microsoft, but Google supports several other 2FA mechanisms in additi…

I think this is true of "Second Wave" black metal bands but less true of more recent output.

What properties does email have that asynchronous messaging services (e.g. Signal) do not?

Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Sign…

Most interesting e2e projects have abandoned email, specifically SMTP, as a secure messaging platform. I would look outside SMTP-based solutions if I were to start using a differen…

Praetorian | Security Engineer | Austin, Texas | REMOTE (For principal and staff positions) Praetorian is different. We are a collective of highly-technical engineers focused on he…