The addresses had no dates
A release token showed up in use from four machines in AWS that I couldn't account for. Two hours later it turned out to be my own runner fleet, and I'd fixed the real problem anyway.
Categories
13 pages
Security
Every suppression is a claim
Forty-two comments telling a checker to stand down. I went through them one at a time to see what each was actually asserting, and some of them were wrong.
My reason for hand-rolling it was wrong
I wrote my own OpenPGP packet code, then deleted the lot to prove I needed it. The reason I'd given turned out to be nonsense, and there was a better one waiting for me.
Half the AI traffic was a scanner in a costume
The busiest AI crawler on this blog nearly doubled in a month. Most of that wasn't the crawler at all, it was something hunting for .env files wearing its name.
Bringing Cloudflare in from the cold
Everything on AWS here runs on credentials that last minutes. Cloudflare I'd been clicking by hand, and bringing it in meant living with a long-lived secret and making it as small as I could.
Two encrypted emails in twenty years
One of them was from me, testing it. I'd still publish the key, and the reason isn't cryptographic.
The marketplace I had to defend from my own attack surface
Opening a public marketplace for agent workflows meant publishing an attack surface, and then having to defend it from my own convenience.
The secret that wasn't on my branch
A secret scanner failed a merge request over a test key and a documentation PEM that the change did not contain. Scoping a scan properly.
Bought, not stolen
The philosophical end of the signing series: a stolen key and a bought one produce the same signature, and trust has to survive both.
A signing key that never leaves KMS
Generate an asymmetric RSA-4096 signing key inside AWS KMS with no export path, then sign releases by calling kms:Sign instead of holding the key.
