161–169 of 169 posts
Earlier quoted context omitted.
SOPS reduces the surface area you need to cover. You can use Age as a backend and then you only need a long lived private key on the server. https://github.com/getsops/sops
The bad guys will steal that private key and decrypt the encrypted secrets the same way they can steal the unencrypted secrets directly.
Earlier quoted context omitted.
How did they get leak them? Just someone getting into your personal Claude Code logs? I'm surprised that if it was just that Google would even be aware they're leaked.
Claude was looking up env-vars during the coding session which ended up in ~/.claude/projects/ log. I wanted to make the [construction] logs public with the code. Didn't think that was a leak vector.
Earlier quoted context omitted.
Claude was looking up env-vars during the coding session which ended up in ~/.claude/projects/ log. I wanted to make the [construction] logs public with the code. Didn't think that was a leak vector.
How would Google or OpenAI have alerted you? Anthropic could alert you because they scraped their keys and detected on of their keys in the logs. If anything, it’s bad that Anthropic only notified you about their key, and not the other keys that have leaked.
Claude (or other LLMs, for that matter) wouldn't know they leaked the keys because I did, by trying to make the construction logs public. I just wasn't expecting the logs to have keys in them from my env vars.
Earlier quoted context omitted.
I'll bet money any new React/K8s/${WEBSCALE} stuff they're building is still just a wrapper over the same old inventory management they've been using for years...probably something like JDEdwards on AS/400.
You would lose that bet. Walmart has invested a LOT in modernizing stuff over the last 10 years. You cannot deliver groceries in less than an hour using the old inventory. It's not perfect, but what it's been done given the scale , it's nothing short of a miracle. Source: I have been working there for 10 years.
Earlier quoted context omitted.
Equifax? Capital One? 23andMe? My basis for this is that you can leak everyone’s bank data and barely have it show up in your stock price chart, especially long term.
Stock price is an extremely narrow view of the total consequences of lax cybersecurity but that aside, the notion that security doesn’t matter because those companies got hacked is ridiculous. The reason there isn’t an Equifax every minute is because an enormous amount of effort and talent goes into ensuring that’s the case. If your attitude is we should vibe code our way past the need for security, you aren’t respon…
see Solar Winds, Microsoft etc.
Earlier quoted context omitted.
Fully this. Every Ace or Do It Best I've been to in Washington has had at least one Rugged Grandpa ™ on staff who could have given me a PhD-level essay on whatever I asked them about; at Home Depot I'm lucky if the folks there have any idea what an impact-rated bit is or why I specifically need one and NO please stop trying to sell me this other crap if you're sold out of the impact bits, they are NOT the same! (It g…
I am buying an impact driver for someone for christmas. Any recommendations on a fastner/drill bit set?
Earlier quoted context omitted.
> Other stores have figured this out. Not CostCo though! I open their page and immediately 'Can Costco.ca use your location?" I say yes and then it asks me what province I'm in. I tell it, and then it defaults me to a store 30 minutes' drive from here and not the one five minutes away. Every. Time.
Costco’s website is worse than useless. It doesn’t tell you anything useful beyond the hours. I have to believe it’s intentional.
Pizza pockets? Okay, anything that mentions pizza, or pockets. So frozen pizzas, in-store-made pizzas, pizza flavored pringles, pants with pockets, dresses with pockets, frozen items that are similar to pizzas but aren't pizzas, frozen items which aren't similar to pizzas, granola bars I guess, basketballs, and so on.
It seems as though their search just takes the search terms, matches them against every item in their database in order of relevance, and then just shows you everything regardless of how relevant it is. 0.00121 out of 100? Well, it's still technically relevant! Let's show it just in case!
I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens. It seems like a cheap and simple thing to offer your customers a little extra safety. Anybody interested in starting a platform agnostic service to do this?
GitHub already has a program to scan for keys, since publishing Discord tokens by mistake used to get the token immediately revoked and a DM from the system account saying why
Thought the mechanism was a little unclear in your specific example - did Github revoke Discord tokens?