I build things and help people grow. Silly dad jokes, entrepreneurship, cooking & baking, travel, open source, security and mobile.
Joined June 2009
- Tweets11.3K
- Following2.9K
- Followers1.6K
- Likes2.5K
Our @rmbuginc site saw thousands of percent increase in number of visitors today. Should I write a post on the steps we took through the past decade that brought us here?!
Mario Đanić retweeted
[EKSKLUZIVNI INTERVJU] Startup rmBug, koji su osnovali Luka Kladarić i Mario Đanić, hrvatskog dvojca osigurao 400.000 eura investicije! 🚀
Kada izlaze na tržište i koji ih sve izazovi čekaju, otkrivaju u intervjuu: netokracija.com/startup-rmbu…
Access control lists are a lie we tell ourselves. You gave 47 people access to production. You have no idea what 44 of them are doing with it.
Something I’ve been building for quite a bit is almost ready. If you care about who accesses your database (and you should), keep watching this space.
Your database is the only system in your stack where you can't answer "who looked at customer data last week" with a name. Think about that.
Hot take: the best developer experience is when security doesn't require a separate workflow. If your devs need a different tool to access the database securely, you've already lost.
Access grants don’t age well. You gave 47 people access to production at various points for various reasons. You know who was granted access. You probably don’t know what all of them are doing with it today. That gap is worth closing.
Every compliance framework asks: "Can you prove who accessed sensitive data?" Most companies answer with a spreadsheet and a prayer.
The gap between "who has access to this database" and "who actually accessed this database" is where breaches live.
1/ Building a security product is strange. You’re selling people protection against a future they don’t want to imagine.
Here’s what I’ve learned so far.
3/ Lesson two: Security products that make people’s lives harder don’t get adopted. They get resented, then bypassed, then blamed when something breaks.
The best security is the kind people actually use.
Make it easy for agents to become your user.
Rewrite your CLI for agents
justin.poehnelt.com/posts/re…
Audit logs say "db_readonly." That account has 23 active users.
They narrow it down to a team. Never to a person. File the incident report with "likely."
That's why I'm building @rmbuginc.
If your database audit log says "admin" ran a query, you don't have an audit log. You have a fiction.
I'm building @rm_bug to fix database access. Here's why this problem won't leave me alone.
Every company I looked at had the same thing: shared credentials, no audit trail, and a prayer that nobody does anything stupid.
Identity-based access exists for every other system. SSO for apps. IAM for cloud. But databases? Still stuck in the shared credential era for the most part.