Key Under the Mat

One signal 📡 One subtraction ➖ One analogy 🔑

Created by Sam Rogers of Snap Synapse | Episode 18 with guest Tim McAllister | The Sunday newsletter of the weekly show at sigsub.show

---

🔑 Analogy of the Week: Key Under the Mat

Most of us grew up with one. A spare key under the mat, under the flowerpot by the door, or inside the fake rock that fooled nobody. It worked for years, and not because it was hidden well. It worked because we trusted that no one was going to walk the street at night flipping every doormat to find out.

That was the whole security model: effort. A burglar has one night and one pair of hands, and checking forty front steps for a key isn't worth it when there's an unlocked car down the block.

Now picture someone who can flip every doormat on every street in town, all night, without getting tired or bored. The key didn't move. The mat didn't change. Looking just stopped costing anything. And unlike a shifty figure in the night who might be spotted under a lamppost or porch light, you may never know the agent is there until well after the keys are long gone...if even then.

The key was never hidden. It was just more trouble to find than it was worth.

---

📡 Signal: The effort math stopped working

Tim McAllister, a Regional Field CTO at DigiCert, sat down with me in Santa Rosa for the show's first in-person episode, the week a set of flaws in PHP went public. PHP runs about two-thirds of the websites whose server-side language is known, and it's been doing that for over twenty years. Some of that old code was left alone, Tim said, because finding the exploit "just wasn't worth the effort."

That math is gone. The PHP fixes shipped on October 21 after a month of private disclosure, and Tim's read is that it "still wasn't in time for pretty much most of the internet." When an agent can scale up and scale out against one target, patching "is always going to be reactive." His conclusion is that the new standard procedure is containment, and to "get ready for rolling internet blackouts."

My half of the signal is the same math from the other side. A lot of the web was built on the assumption that "it's too much work to do this, nobody would ever do this." Maybe those of us with bodies wouldn't, but bots sure would, and as of this spring they're the majority of all internet traffic. They also "don't know when to back off." An agent that keeps retrying can look like an attack whether or not it is one.

Effort used to be a lock. Most of what we built still assumes it is.

---

➖ Subtraction: Security through obscurity, starting with mine

I'm guilty of this one. There are things I put on the web twenty years ago that I never went back to, sitting behind a password nobody would think to guess. Not exactly "password123," but still a fairly weak password by today's standards, with no real care to the authentication method behind it.

We knew that it was bad, but there weren't necessarily bad things happening all the time. And now there very much are. So I'm subtracting anything in my stack that's protected by a simple password and nothing else. That's a hard line with consequences. But consequences are coming soon one way or the other and I'd rather steer clear of the blast radius, wouldn't you?

Tim's version is industry-wide: the long-lived API tokens behind the services we build on, with coarse scope and no expiry, left alone for years because they're "such a pain in the butt to change." Supabase now scopes its tokens and gives them an expiry. Most of what we run doesn't yet.

What we get back is the one thing obscurity never gave us: knowing it's protected, rather than hoping nobody looks.

If the only thing protecting it is that nobody's bothered to look, it was never really protected. It's just been waiting until right about now for the big reveal.

---

▶️ Watch, read, or listen

The full conversation with Tim, with the transcript and every format, is at sigsub.show/episodes/ep-018.

Jump to a segment: not worth the effort · nobody would ever do this · containment over patching · the stack that stopped working · out of the loop, to a point · security through obscurity · long-lived tokens · pick one tool

---

🧭 Take It to Work

The day the PHP news broke, Tim checked his own automated AI security stack and found most of it "was not operational," with "no notification, no transparency, no visibility." His first move was an inventory: every system he runs, its version, and whether there's a newer one. Now that report lands in his inbox every day, and if it doesn't arrive, that's the alarm. He's working out what an agent may patch without asking him. His Mac's operating system, no. "PHP, definitely."

This week's takeaway, The Report-Only Fortnight, is built directly on Tim's Daily Patch Loop: two weeks of reports before any agent is allowed to change anything, so we know what it would have done before it does it. Its companion, The Vendor Update Card, asks a vendor how its product changes after we've signed.

Name one AI tool your team runs. What version is it, what can it reach, and when did anyone last check? Send me your answer, or bring it to the show. If nobody knows, that's the answer too.

While you're in there, rotate the keys, "just for practice." As we said on this week's episode, it won't hurt, "but it may very well hurt if you don't."

More securely,

Sam Rogers Collector of Spare Keys

---

New here? Subscribe at sigsub.show and the next episode lands in your inbox.

Somebody on your team knows where the spare keys are hidden. They're the one to forward this to.

Related reading:

• Security Isn't About Adding More (013): subtract exposure before buying more defense, starting with the orphaned accounts nobody owns. The old passwords and immortal tokens are the same subtraction, a year on and with less time to do it.
• Dig the Second Hole (066): bounds we need kept are architecture, not instructions. On this episode I put it as "either it's architecture or it's broken," and a password nobody would guess was never either.
• Better Boiled Water (073): tools change under us without asking. The Vendor Update Card is the question to ask before they do.
• Every episode's takeaway: sigsub.show/takeaways.

This week's guest: Tim McAllister, whose tools and write-ups, including the Daily Patch Loop, live at timmcallister.io.