You can say "everything can be exfiltrated" but capturing my PC's password is about nigh unto impossible. The only way it can be captured is if a program has active control over the keyboard controller/associated drivers when I type in the password to unlock it.

These problems were all solved a long time ago.

▲

justincormack 15 hours ago | parent [-]

Plugging a keyboard into your Railway instance every time you start on app is not going to give you a great SaaS experience.

	▲	NichoPaolucci 12 hours ago \| parent [-]
		I think some of this conversation is circling around the concept of 'allowable risk'... We have a couple of VMs that are not mission critical, and they don't hold sensitive data. We just inject the secrets into the runtime. Access to those machines is restricted to a single IP, there's not much more protection in front of them. A meaningful attack on one of those machines would require a LOT of effort, and almost nothing in return. Some systems don't NEED to have government level security, as a developer it's my job to provide the best solution for each scenario. (IE, I wouldn't put 12 security cameras and an armed guard around a fruit stand, but I might around a jewelry store)