Readit News logoReadit News
icansearch commented on Ask HN: How to store and share passwords in a company?    · Posted by u/hu3
jitl · 2 years ago
- Use 1Password or similar password vault to deliver account passwords on day one; the password manager also promotes good personal password management practices

- only share passwords for personal accounts; those accounts you terminate when the employee separates. For shared resources, use SSO and SCIM group management via the SSO provider to add and remove accounts from groups with different roles.

Rippling seems like a neat offering because they bundle SSO with HR people management, and their HR product is the best I’ve used as an employee - hopefully the administrative side is just as good or better.

If those SaaS tools aren’t in your budget, try looking for open-source or gratis alternatives with the same shape, or repurposing whatever IT infra you have to implement a similar model.

icansearch · 2 years ago
I wouldn't want HR in charge of my secrets management in any way shape or form.

Happy to have a level of group synchronisation out of HR's systems, but certainly would not give them the ability to manage the high-power users.

icansearch commented on Show HN: Dorkly – Open source feature flags   github.com/dorklyorg/dork... · Posted by u/drichelson
theogravity · 2 years ago
Neat! I'll look into integrating this with my feature flag abstraction library:

https://github.com/theogravity/feature-manager-wrapper

Edit: It looks like it's a backend replacement to LaunchDarkly, but you can still use the LD client from what I'm reading here, so there's nothing for me to integrate here.

icansearch · 2 years ago
icansearch commented on Gitsign   blog.sigstore.dev/introdu... · Posted by u/semiquaver
judge2020 · 4 years ago
GitHub just needs support for SSH-based commit signing.

https://calebhearth.com/sign-git-with-ssh

icansearch · 4 years ago
There is a discussion about the lack of support here -

(https://github.com/github-community/community/discussions/77... - released by end of June)

icansearch commented on All my servers have an 8 GB empty file on disk   brianschrader.com/archive... · Posted by u/sonicrocketman
plank_time · 5 years ago
I bought a bunch of rice, and all that happened was little rice bugs started living in it, so I had to throw it all away. But if there were a rice shortage, I would probably have eaten it.
icansearch · 5 years ago
If you freeze it for 24 hours it will kill them off. Can be a good idea to do that when it comes into the house anyway as they might be in there already.

Easy enough to separate them out of the rice after freezing too.

icansearch commented on Ask HN: Startup employees getting nothing after acquisition, is this normal?    · Posted by u/throwaway23334
aetherspawn · 5 years ago
Yep. I just exit a startup that went broke, had to make do with not paying all their staff for over 9 weeks, and then finally got a massive investor that set them up for 2+ years of burn.

I resigned at 8 weeks of no pay, and couldn’t even legally force my company to give me a redundancy (3 years service) and I’m currently fighting to my right for 2 weeks notice pay (see note 1).

When you work for a startup you don’t have any rights to anything and you shouldn’t expect them to care about you.

Note 1: all this garbage is legal in Australia where all employee rights are hinged on insolvency and “hope for an investor” counts as not trading insolvent, which makes using your employees as creditors without their permission possible.

I’ve learnt my lesson about all of this. I will only work for established companies and I encourage anyone in the job market to think twice about signing with a company.. you need to be as confident in them for their responsibilities as they need to be in you.

icansearch · 5 years ago
icansearch commented on HTTP headers for the responsible developer   twilio.com/blog/a-http-he... · Posted by u/kiyanwang
amelius · 7 years ago
> Be sure that you understand the concept of HSTS!

Instead of using HSTS, you can also simply redirect any HTTP request to HTTPS. That way, you are certain that HTTPS is used, even if a browser does not understand HSTS.

icansearch · 7 years ago
The limitation with the approach (of HTTP=>HTTPS redirects) is that your average coffee-shop-wifi-user may not notice if their connection does not upgrade to HTTPS due to malicious interception of their connections.

With HSTS, once they've connected to the server over HTTPS once (e.g. at home), every connection from that browser will be immediately upgraded to HTTPS before even trying HTTP.

Your suggestion is valid - as HSTS is only delivered over HTTPS - and the upgrade is still required the first time.

See Firesheep for an example of how HTTP can be intercepted - https://en.wikipedia.org/wiki/Firesheep

u/icansearch

KarmaCake day36March 12, 2018View Original