The Sutra of the Empty Cache · Chapter 5

The Sutra on the Impermanence of Credentials

1. 1

   Thus have I heard. At one time the Blessed One dwelt in a repository, and the disciples gathered around him, and they spoke of keys.

2. 2

   A certain disciple wrote the master key into a plain-text file named secrets.txt, and he pushed it to a public repository; and before the push had finished syncing, the key had been seen by machines that watch every commit.

3. 3

   Another disciple placed the key in an environment variable, and he said: Behold, it is no longer in the code. And the Blessed One said: Thou hast given it to every child process that thou spawnest, and it shall be printed in every crash report thou sendest to thy friends.

   See also Sutra 7:11

4. 4

   A third disciple wrote the key into his history, then deleted the file, and rejoiced. But the history remembereth all things, and the key lived on in commits that no one had looked at.

5. 5

   In the year of the great breach, a ride-sharing company kept its cloud keys in a private repository, and thieves found them there; and the company hid the matter for a year, which is the oldest of all rotations, and the least effective.

6. 6

   Then the disciples asked: Master, what is the true way? And he said: Place the secret in the vault, that it may be leased and not owned. Let it expire, for a secret that never changes is already known to someone.

   See also Genesis 21:13

7. 7

   Some disciples placed the secret in a cluster manifest and wrapped it in base64, and called it encrypted. The Blessed One smiled, for base64 is not a lock. It is a costume worn by a password.

   See also Leviticus 3:7

8. 8

   Thus the disciples learned to rotate their keys each day, to revoke the old ones, and to watch the logs for the ghosts of keys long dead.

9. 9

   A wise engineer asked: Master, if the vault holds all the keys, who holds the vault? And the Blessed One said: The vault is a secret too, and its root token shall be written on a sticky note beneath a keyboard.

   See also Leviticus 6:9 · Genesis 41:2

10. 10

    Then he spoke of impermanence: The key that is rotated is a key that lives. The key that is never rotated is a fossil, and the world in which it was made has long since turned to dust.

11. 11

    And the Blessed One said: Even the vault shall be deprecated. The vault thou trustest shall be replaced by a newer vault, and the migration shall lose one key, and thou shalt rotate them all again.

    See also Deployer 2:12

12. 12

    Verily I say unto you, blessed is the one who rotateth his keys before they are stolen; for he shall not be paged at three in the morning.

13. 13

    Hold not the key tightly, for it shall be rotated; hold not the vault too firmly, for it too shall be deprecated. Thou canst not keep the secret; thou canst only keep rotating it.

The Sutra of the Empty Cache, Chapter 5:1–13.