Episode 323 - Secrets Logs, Prompt Injection Risks

Let's start with the logging one, because Crocs and socks and logging is my jam.

The fact that we don't do it enough, or if we do, we tend to have problems with it.

So let's see where I put that.

This is by Alan Reyes.

And this is actually an old article.

I don't know if you noticed that, Ken.

I'm not quite sure why it popped up in my feed, but it's an old article.

It's a couple years old.

I

think it was a pop from 2024 at Locomoco, wasn't it? I think it might have been,

yeah.

But no, I like it because I'm like, this is literally like one of my biggest, this is one of the hardest things to deal with when you're building a product, like when you have a product that has a lot of, it's like you know more than most about the architecture of my system and how many different systems there really are and how many things are spread out and how many services are spread out.

and how decentralized it is and the more decentralized you have a system of a setup that you have it really does get hard to stay ahead of this stuff i mean you you can yeah anyways i'm sorry i'm getting ahead of ourselves maybe we should even just why don't you just tell people what the article's about before i go

on tangents TLDR.

I appreciate Alan putting this right at the top, right? There's no silver bullet.

But if we put some lead bullets in the right places, we have a good shot at keeping sensitive data out of logs, right? So it is.

It's a blog version of the talk he gave at Locomotive Tech 2024.

Yeah, you can just watch the video, flip through the slides if you would like to.

But this feels very apropos because we are having constant problems with secrets.

And part of this is AI related.

Part of it is logging related as we're trying to get some sort of observation into these systems that we're creating because we no longer have as much control over what we're building.

And so things just keep showing up in unexpected places.

Logging has always been one of them.

We've talked about this problem of passwords is always my favorite one.

People are like, oh, well, we've never put passwords in the log.