11–19 of 19 posts
Earlier quoted context omitted.
Storing the secret on a hardware token will most certainly help with not committing into source control.
Most use another build host siloed from the dev staging area, regression tested/audited, and with limited administrative access. =3
Earlier quoted context omitted.
People don't need an extra supply-chain failure mode to consider, and CVE proved these dongles are mostly security theater. Likewise, the recent Coinkite user key prediction breach certainly wasn't cool for folks that lost their holdings. =3
> these dongles are mostly security theater ...as opposed to? What's your criteria for "non-security-theater"?
Probably would conclude dev staging areas can't run continuous integration with the current design team. Asking them to take on additional tasks while they already are YOLO'ing it with an LLM is a suckers bet. =3
Earlier quoted context omitted.
Most use another build host siloed from the dev staging area, regression tested/audited, and with limited administrative access. =3
Ye, and how do you get source code from devs into that silo?
I should also add even simple visgrep and xdotool can automate a lot of checks that normally takes hours of repetitive testing.
Best of luck =3
Earlier quoted context omitted.
The signing key for Firefox stored on a single hardware yubikey available to a single person?
Multiple hardware devices can have the same key.
It would be good if there way a way to attest that a key was generated on and bound to a specific HSM.
Earlier quoted context omitted.
The signing key for Firefox stored on a single hardware yubikey available to a single person?
Could be multiple individuals, each with a different key. https://eprint.iacr.org/2020/540 https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing
You can use SSS to encrypt the signing key, but then you need to fully materialize the signing key to actually sign the release. Which makes the exact situation that occurred here possible.
The only way to do multi-signer PGP is outside of the PGP protocol, you just need to sign the artifact multiple times then have the verifier assert that a sufficient number of signatures are present. But again, this isn't supported by the regular PGP tools.
If the signing subkey was committed, that implies developers have it as a file on their system which I find surprising if true. They should be using hardware like a Yubikey or something. Especially for something this important.
Key-committing AEAD: https://en.wikipedia.org/wiki/Authenticated_encryption#Key-c...
Signing Git commits: https://docs.github.com/en/authentication/managing-commit-si...