XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by kortilla on Sunday March 31, 2024 @03:13AM (#39882131)

Private keys are also “secrets” here in the security world.

“Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing”

Your distinction is not shared by the industry so it’s not something helpful to correct people on.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tialaramex on Sunday March 31, 2024 @09:44AM (#39884179)

I don't think I can take seriously in this context a quote in which certificates (a type of public document) are also designated "secrets".

Like, sure, they're probably thinking of PKCS#12 files which actually have the private key inside them, not just the certificate, but when they are this sloppy of course they're going to use the wrong words.

[ Parent | on HN ]