ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
norg 3.x Credential Expiry When upgrading from norg 2.x to 3.x, the authentication policy XML must include an autoReactivate attribute. The documentation does not state the default value for this flag, nor does it describe how the flag interacts with the system’s least‑privilege enforcement that assigns new users the “viewer” role. If autoReactivate is enabl
Least-Privilege Scope with Redis ACLs Redis 6.0 and later support Access Control Lists that restrict a user to specific key patterns with the ~ prefix alongside granular command permissions. When designing a least-privilege account, I want to confine an application user to a single namespace such as ~cache:* while still allowing ordinary read and write comma
Goal Determine the correct handling of expired root passwords during privilege escalation on KDE Neon 22.04 LTS, which ships polkit 0.115 and relies on systemd‑logind for session expiration. Context Polkit 0.115 introduces a stricter default rule set that requires explicit authorization for any elevation. When a user’s password reaches the expiry date, syste
Goal Determine whether a Turbo Streams WebSocket connection remains open or automatically reconnects when the server detects that a user’s authentication has expired or been revoked. Constraints Least‑privilege enforcement relies on server‑side middleware; the stream endpoint must reject messages from unauthenticated or unauthorized users. When a session tok
Goal Determine whether Racket’s built‑in racket/auth module automatically invalidates credentials once their credential-expiration timestamp passes, or whether this enforcement must be handled entirely by application code. Current Constraints The auth module provides require-credentials to guard handlers, but it returns a generic 401 for both invalid and exp
Terramate orchestrates Terraform by generating HCL files from templates and managing stack-based variable propagation. While this reduces duplication across multi-account or multi-region deployments, the orchestration layer does not replace the underlying cloud provider's IAM requirements. When managing multiple stacks that require distinct authentication co
Integration boundary A Delphi application is planned to use FireDAC for least-privilege database access and RAD Server/EMS for token-based API access. The design goal is consistent credential use and handling of expired credentials across the two component boundaries. FireDAC supports least-privilege access via connection parameters and delegates authenticat
Secure Design Phase Scope The Microsoft Security Development Lifecycle (SDL) requires applying the Principle of Least Privilege during the Design phase, using threat modeling to identify trust boundaries and reduce the attack surface. A documented element of this approach is replacing static credentials with short-lived tokens, automated rotation, and a mana
CircleCI Project API tokens are used to automate build triggers and manage project-level settings. While these tokens provide isolation between different projects, they currently lack granular permission scopes, granting broad access to all project-level API endpoints once authenticated. When managing credentials at scale, the lack of a native expiration mec
redis
terraform
delphi
sdl
circleci
norg