You don't want long-lived keys

The post says the quiet part loud: those forever-keys are trouble, and rotating them is a nightmare. The article pushes short-term, auto-expiring credentials—less drama, fewer outages—and points to simple swaps like temporary SSH logins (think one-time door codes), PyPI Trusted Publishers for releases, and SSO logins instead of passwords. You can’t ditch every long-term secret, it admits, but shrinking the list means you can lock down the few that remain. Sounds tidy—until the comments lit up.

One user kicked off with comedy: the site’s background “looked like dust” on their phone—perfect vibe for a debate about cleaning up old keys. Then the fight begins. “You don’t want keys at all,” insists one, arguing for continuous checks instead of copy-pasting secrets. Real-world ops snaps back: we still need long-lived access for tools that talk to each other—like Sentry to Jira—and constant token refreshes are a chore. Meanwhile, the math crowd says rotating weak keys isn’t security; make the keys longer. And the hardware squad rolls in waving HSMs and FIDO2 keys: lock the crown jewels in a vault and hand out disposable passes. Between horror stories of rushed rotations and “who even made this key?” archaeology, the mood is clear: everyone hates keys—just not the same ones. For the curious: EC2 Instance Connect is the “keys-but-make-it-temporary” poster child.