Comment by thrownaway22 | Hacker News Reader

Comment by thrownaway22 | Hacker News Reader

Parent Full thread

Baseten carries the Soc 2 Type II and HIPAA Compliant logos on its front page. They also have logos for customers including: OpenEvidence (medical related, used by almost 2/3 of physicians in the US, claim HIPAA compliance), Harvey (legal related, claim "binding terms on data protection, data access, incident response SLAs, and other controls aligned with SOC2, ISO, GDPR and other standards.")

From TFA:

> That token had admin and push access to Baseten's main product repo, the GitOps repo that drives their clusters, and their Homebrew tap, plus read/write access to other private repositories including specific repos per customers.

> The image build dated to March 2023, and the token still worked when we found it in July 2026.

What are the legal implications here?

Given the build is from 2023 one would expect that at least the token would have been rotated, and I suspect some of these compliance checks do require rotation of tokens/passwords.

That said, the whole compliance industry is a joke.

I tried to open a conversation with an entity that issues ISO27001 certificates about the stuff I had found at a company they had recently certified. The response was such that I have lost faith in that entire industry. It's essentially a well dressed up pay-to-play.

Totally, it's really a whole bunch of theatre to sustain an economy of leeches and middleman on your margins.

tokens yes, password rotation, no.

In 2017:

> NIST changed the guidance with SP 800-63B, published June 2017. It explicitly said:

"Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)."

Instead, passwords should be changed when there is evidence they have been compromised, not every 30/60/90 days.

Box checking is an important business!

I can’t help noticing that an LLM can check boxes.

Unless github had regulated data, unlikely, the legal implications are few. Document the issue, remediate and no findings on the next audit. Done.

Reply on news.ycombinator.com