So, @frameworkcomputer has a data breach. And they don't even tell me if I was affected or not. Great. Also great that it affects stuff like my address, which I for sure easily can be changed. Also, why tf are you storing login IPs?!
Best thing is, metabase, the software they are using, is fucking AI dogshit aka vibecoded.
I swear if I knew this I would have never ever bought a framework laptop. This whole company sucks. (1/x)
@commanderred@frameworkcomputer based on their disclosure, it sounds like the attackers had full access to the db, it is possible that some data was hashed or encrypted but let's be honest here and assume it wasn't. I'd wager that you and I are not exempt.
@vivithecanine@commanderred Would actually love to see a benchmark in a real world application of how encrypting certain data in the database scales and works performance-wise. It would certainly break a lot of the advantages of, well, having a queryable database, but you don't always neeeeeed to have everything queryable? Certainly an interesting engineering challenge
@star@commanderred encryption at rest isn't a big deal at all, encrypting sections of a database at runtime is something you can solve with software like Google tink developers.google.com/tink
In a correctly designed system the crypto keys are stored off somewhere else so if the db gets slurped up at some point, it doesn't matter if it gets stolen on a running machine, out of ram, or off the disk if you use something like this.
@commanderred@vivithecanine Well, I do think that db-level encryption is not exactly a common practice at all though. I am unsure how often this is done
@commanderred@vivithecanine Yes I just don't think that not doing so is particularly generally bad. I mean, everything I can think of is doing it this way
- Professional Schoßkatze
@commanderred@chaos.social
