Secrets Don’t Belong in Config

Links
21

Regardless of how it was written. I found the content to be useful to invoke thinking about how I want to approach secret deployment in my future workflows.

SecretSpec looks interesting, I plan to look at it in the future.

LLM Assisted? Yes. Slop? I do not think so.

6 Likes
22

Requested publicly, so I’m responding publicly. I don’t think that’s merited, for a few reasons:

  • The posts that aren’t directly about Domen’s blog post are about reactions to said blog post, and then interpretations of the reactions to said blog post. Is it strictly on topic to discuss ‘witch hunt’ norms here? Not exactly, but it’s also not framed in a way such that it would be a productive top-level conversation either. Discourse isn’t a perfectly structured repository of information; it captures conversations more than anything else, and while we try to keep it organized so that those conversations can be referenced later, and focused toward making those conversations productive and targeted at the right audiences, sometimes things are naturally messy.
  • The digression seems to have arrived at a natural conclusion anyway. I don’t think a move at this point would affect how productive the digression was.
  • In Links posts in particular I’m inclined to give some extra leeway with respect to topicality. There’s no question being asked of the community here, nor is there a particular problem we’re attempting to solve; the essence of such posts is, ‘Here is a thing — discuss!’ And the community has discussed! I’d move true non sequiturs, but this digression arose out of the thing that was offered, and so I think it’s reasonable to leave it as is.
2 Likes
23

Thanks! We’ve spent a lot of energy making the design sound and well tested.

I was surprised to see there’s even Windows users (also all SDKs are built for Windows) besides Linux and macOS.

What a time to be alive!

1 Like
24

I personally wish there was more moderation on people who are against LLMs and rant in any form, because they are derailing the conversations from the topic (while there’s plenty of existing threads to vent).

Ironically, it seems like they argue for higher quality content while not adding much besides repeating the word slop.

Also as @aanderse pointed out, there are unnecessary personal attacks all over the place needlessly tolerated.

I get some people don’t like it, but noone of this is productive. We’re going to keep using LLMs.

my 2c to moderation team

15 Likes
26

We’re going to keep using LLMs.

Well some of us haven’t started and dont plan to. I do agree with Domen here that the discussion regarding LLMs should have been left at “please disclose”, which Domen has done and I thank him for it.

Thats all from me. So i am in favor of everything LLM related being moved or just straight up deleted as its not relevant anymore.

4 Likes
27

Agreed that there should be stricter moderation of the off-topic anti-LLM comments. The link you posted is interesting and worth discussing. SecretSpec is interesting and worth discussing. Users of this forum deserve to be able to have those discussions without having to scroll past pages of endlessly regurgitated arguments about AI.

7 Likes
28

Speaking personally, I see the duty of moderation (in the sense of a debate moderator) as not to put the thumb on the scale on any particular side of the issue, but to provide the structure and protection needed for the best arguments on both sides to surface.

I agree it would be nice, in a librarian-mindset way, for the debate over LLM use to be isolated to dedicated topics and not to flow over into others. I have a hard time seeing how to do that in a way that doesn’t effectively put a thumb on the scale, when those other topics are examples of people using LLMs in the community, and are therefore ipso facto pro-LLM arguments. So implicit pro-LLM arguments can happen anywhere, but their rebuttals are confined to a flame thread? That doesn’t seem like an effective way to get to the best arguments on both sides.

I will moderate personal attacks regardless of who makes them. The closest thing to a personal attack I’ve seen here is the thing about personal anxieties, which to my reading is less than maximally sensitive but it was in response to a person saying ‘my concern: […] I feel like I need […]’; characterizing that as a personal anxiety is not obviously an attack, to me. (Not to be dismissive of the person saying that it was interpreted as a personal attack — your reaction is also valid. Ideally your interlocutor would listen to your reaction, clarify their non-hostile intent, you each would extend good faith to each other, and hands would be shaken all around.)

And to keep this from being more off-topic: further personal feedback to me or @moderation-team in general is welcome via PMs, and if you have anything to say in public about these comments, please use the Meta > Moderation category.

13 Likes
29

My 2c: I’m happy to not interact at all with LLM posts if they’re stated as such up-front.

4 Likes
30

+1, and I’d go one step further and expand this to also protect secrets at runtime: secrets don’t belong in applications.

Keys belong in HSMs/TPMs, or exposed via authenticating proxies.