Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address GitHub Issue #1265 #1266

Merged
merged 1 commit into from
Dec 26, 2023
Merged

Address GitHub Issue #1265 #1266

merged 1 commit into from
Dec 26, 2023

Conversation

kwwall
Copy link
Collaborator

@kwwall kwwall commented Dec 26, 2023

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

  • In case of a new Cheat Sheet, you have used the Cheat Sheet template.
  • All the markdown files do not raise any validation policy violation, see the policy.
  • All the markdown files follow these format rules.
  • All your assets are stored in the assets folder.
  • All the images used are in the PNG format.
  • Any references to websites have been formatted as [TEXT](URL)
  • You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
  • The CI build of your PR pass, see the build status here.

If your PR is related to an issue, please finish your PR text with the following line:

This PR covers issue #.

Thank you again for your contribution 😃

@kwwall
Copy link
Collaborator Author

kwwall commented Dec 26, 2023

Note that vscode's markdownlinter found a few warnings in other sections, but nothing in the section I revised. I did not address those.

@jmanico jmanico merged commit 4afe7ec into OWASP:master Dec 26, 2023
3 checks passed
Copy link
Collaborator

@szh szh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a bit late but I added a few grammar nits.

the secret. By that point, the security breach may have already occurred.

Depending on your particular circumstances, this can be difficult implement in a
manner that ensures memory security. Since determining whether it is beneficial
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think "Since" is the wrong word here. Is there a word that more clearly connects these two sentences?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you like to me do a new PR for these edits? Sorry if I was going too fast.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure

[Meltdown and Spectre](https://meltdownattack.com/), it is important
to understand that the operating system alone is not sufficient to protect your process
memory from these types of attacks. This becomes especially important when your
application is deployed to the cloud. The only fullproof approach to protecting memory
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"fullproof" should be "foolproof"

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@szh - SMH. I can't believe I messed that up. I even looked it up because I always get it wrong, and I still got it wrong. Sigh.

memory from these types of attacks. This becomes especially important when your
application is deployed to the cloud. The only fullproof approach to protecting memory
against these and similar attacks to fully physically isolate your process memory from all other
untrusted processes.

Nevertheless, in highly sensitive environments, protecting secrets in memory can
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if "Nevertheless" makes sense in this context anymore, given the previous paragraph.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants