Comment by xyzzy123 | Hacker News Reader

Comment by xyzzy123 | Hacker News Reader

Parent Full thread

It's also interesting how much worse security gets with all this RCSR oversight.

Because the policy teams don't understand the technical details, they get hung up on things that don't matter so all your "security budget" (in terms of dev effort available for improvement) gets spent on useless things.

Because there is a CIS guideline recommending "do not put secrets in environment variables" in k8s, a team I work with recently spent two weeks modifying deployments of all their third party charts to mount all secrets as volumes, this included modifying / patching upstream helm charts. This will be a maintenance burden forever lol. Actual security benefit in context is approximately zero.

Meanwhile they COULD have spent that time implementing broadly effective things like NetworkPolicy or CSP for the front-end but now there is no dev time for that.

At the top levels of their process there are plenty of risk x impact matrices but there aren't corresponding effort / payoff assessments, so the things being done end up not being engineering.

"secrets in env vars" (or program arguments) always triggers squeamy smirks off me.

It's a bullsh*t rule. One that would work is a clear mandate, "if you're found to use env vars / args for secrets, you must demonstrate within four weeks of finding that you have implemented code to clear your process' args/env vars immediately after program startup, for the lifetime of the process (and that you moved all secrets to non-cleartext memory)". Given how frameworky-frameworky much modern software is, such action items make folks think ("how on earth do I get state to openssl&Co without env vars", ...).

But alas, the regulations people shy away from any such precise prescriptions - because then, they have to involve themselves with SRE, SOC, CI/CD, and developers for monitoring, enforcement and training/assistance.

So instead, as you say, byzantine Reuben-Goldberg constructs are created exploiting "every loophole in the book" to comply with the rule but not the spirit; software becomes even more of a performance art.

I think, over time, I have moved into the camp that strongly believes all practical security is security-from-obscurity. Starting with the compliance rules around it.

> This will be a maintenance burden forever lol.

Not if they never ever ship an update.

(i - briefly - worked for place that did things this way. They didn't update the chart, but they _did_ use `sed` to update the image tag from time to time.)

Enterprise security is cargo cult to the max. You can run 10 different dependency scanners, static analysers, AI analysers, it doesn’t prove shit. You can be SOC1, SOC2, SOC1337, whatever and still have the most moronic bugs. The same ones looked over by the pen test firms running some basic ass open source tooling and bike shedding over shit that makes no difference.

The same companies won’t run a security bounty program because they think it’s a waste of money.

Security people just don’t get it, they don’t think like the bad guys.

Reply on news.ycombinator.com