Hacker News Reader

Is that system made by a supervillain or a mad scientist? But such system can go amok for any reason. Anyway revocation is already possible by publication on github, telling to GPT or sending an email to webmaster.

View on HN

Credentials published on GitHub are not automatically revoked - what happens is at the discretion of the provider, for precisely this reason.

For example AWS applies a “quarantine” policy that prevents some specific actions[1].

Allowing anyone to report a potentially compromised key is one thing, but allowing anyone to unilaterally revoke a token is another.

1. https://docs.aws.amazon.com/aws-managed-policy/latest/refere...

The alternative is that the key won't be quarantined and the attacker will be able to do everything. And quarantine still means denial of some service, e.g. ec2:StartInstances is denied, but ec2:StopInstances is allowed? So the attacker can shut down the system and you won't be able to start it again?

Reply on news.ycombinator.com