Comment by orf
2 hours ago
Are you really unable to imagine a situation where financial or physical harm is caused by a system abruptly being shut down by a credential revocation, triggered by a random person on the internet?
Be serious.
2 hours ago
Are you really unable to imagine a situation where financial or physical harm is caused by a system abruptly being shut down by a credential revocation, triggered by a random person on the internet?
Be serious.
Is that system made by a supervillain or a mad scientist? But such system can go amok for any reason. Anyway revocation is already possible by publication on github, telling to GPT or sending an email to webmaster.
Credentials published on GitHub are not automatically revoked - what happens is at the discretion of the provider, for precisely this reason.
For example AWS applies a “quarantine” policy that prevents some specific actions[1].
Allowing anyone to report a potentially compromised key is one thing, but allowing anyone to unilaterally revoke a token is another.
1. https://docs.aws.amazon.com/aws-managed-policy/latest/refere...