I think there are two separate concerns here. The idea that long lived secrets survive in plaintext on a disk somewhere is a bad idea that should go away, but also tangential to that people have to have good hygiene around not printing evil things to logs. Latter is a lot harder to catch imo, and is a separate problem
Yeah I ended up finishing a Lava Flow Antipattern, where someone started wrapping of stdout and never finished it. We replaced every value for a key of 'token', 'password', 'secret' with 8 stars in the logs.
We were using Splunk and if you're handing third parties your secrets, you're gonna have a bad time. Sooner or later they'll have a disgruntled employee or a breach.
Comments
I think there are two separate concerns here. The idea that long lived secrets survive in plaintext on a disk somewhere is a bad idea that should go away, but also tangential to that people have to have good hygiene around not printing evil things to logs. Latter is a lot harder to catch imo, and is a separate problem
Yeah I ended up finishing a Lava Flow Antipattern, where someone started wrapping of stdout and never finished it. We replaced every value for a key of 'token', 'password', 'secret' with 8 stars in the logs.
We were using Splunk and if you're handing third parties your secrets, you're gonna have a bad time. Sooner or later they'll have a disgruntled employee or a breach.