[akshatpradhan]

I do have a real tool. Its on ComplianceChimp.com. But its down right now because my TLS Certs expired a couple days ago and I never recorded my Key rotation procedures. I did think about temporarily disabling SSL, specifically for this HN post, but thought against it. We want to do compliance right.

We're fixing the certs now and updating our Key rotation procedures for you all to see in our publicly viewable compliance workbook.

[ceequof]

Not to kick someone while they're down... but a security company screwing up their key rotation is not exactly a good sign.

[akshatpradhan]

There's only so much I can get done with my dwindling runway =(.

But you're right, that getting Key Rotation Procedures documented is the 1st thing I should have done.

This is good feedback actually because now I know that after scoping the assets in my turbo tax-like tool, the very next thing a person should do is write down their key rotation procedures. Its also easier to write out as a procedure because its such a common yet forgetful practice.

We're putting cycles into this right absolutely now.