cad
Joined 15 years ago
Karma
23
Submissions
37
Member since
Aug 25
Recent submissions
Comment · 4 months ago
Comment · 4 months ago
Don't get me wrong but data shows that you will likely fail to keep that api key a as secret and you will also fail to revoke when it becomes necessary. You will definately not going to rotate it frequently as you should.
Good thing about the OAuth2/OIDC is these things will not put the trust on the bearer of the api key, but on actual identity that needs to have the access.
Comment · 6 years ago
Money + heat
Comment · 8 years ago
With nuclino(http://nuclino.com). It's a real time, collaborative markdown wiki.
Comment · 9 years ago
Put it on Kickstarter :) I would buy one.
Comment · 10 years ago
does it support firefox?
Comment · 11 years ago
Ok since nobody asked.. What is the tech stack behind?
Comment · 11 years ago
evernote kind of apps don't work. Except Google Keep. Keep kinda works.
Comment · 11 years ago
a favicon would be nice. It's easier to locate the tab that way especially when it's pinned. (firefox users)
Comment · 11 years ago
Front page is not behind ssl and you can sign up from there. It's easy to change form action target to a malicious url with a simple mitm attack.
> In the 2025 report, we showed that nearly 70% of credentials confirmed as valid in 2022 were still valid as of January 2025, meaning they have not been rotated or otherwise remediated. When we retested the same dataset in January 2026, the validity rate remained over 64%. That persistence is not a rounding error. It is an operational signal that remediation, not detection, is still the industry’s limiting factor.
> In the end there is always some long lived secret. What changes is just where and how it is stored, secured and used.
Obviously. The point here is to reduce the number of them