Comment on Disney hack leads to 1.2TB of Slack communications leaked online

MNByChoice@midwest.social ⁨4⁩ ⁨months⁩ ago

• sheogorath@lemmy.world ⁨4⁩ ⁨months⁩ ago

  Passwords and lotsa creds. I know an infra engineer who stores all of the keys to the projects he’s involved in his message to self Slack. When I asked him about it he told me ‘when I found out that the company billed my time 5x my salary to clients I stopped caring’ and I was like OK that’s fair ¯\_(ツ)_/¯

  source

  • douglasg14b@lemmy.world ⁨4⁩ ⁨months⁩ ago

    Depends. Our engineering slack doesn’t contain secrets for a few reasons:

    1. Secret scanning
    2. We have a /secret bot that will take your secret, store it securely, and then present a GUI for each person with access to display that secret “for just that person”. And then after a set period of time it’s made inaccessible, and wiped from the infra.
    3. Training and knowledge transfer on secret security

    source

    • MNByChoice@midwest.social ⁨4⁩ ⁨months⁩ ago

      “Secret Bot” sounds great!

      Custom in-house or off the shelf?

      source

      • douglasg14b@lemmy.world ⁨4⁩ ⁨months⁩ ago

        In house.

        source

        • -> View More Comments
• ArbiterXero@lemmy.world ⁨4⁩ ⁨months⁩ ago

  And jokes about meatball Ron

  source