On LinkedIn
Since May, most of the internet isn’t human. Most of our security still assumes it is.
With apologies to Terry Bisson:
“They’re made of meat.”
“Meat? On our network?”
“A third of it, now. But they built the place.”
“How do they tell who’s who?”
“They check whether it’s nine in the morning. Whether it flew from Amsterdam to Singapore in ten minutes. They send a prompt to a phone and wait for a thumb.”
“A thumb?”
“Meat.”
“And us? We don’t have thumbs.”
“They file us under ‘service account’. Nobody looks at those.”
“Ever?”
“Until something breaks.”
Cloudflare says bots overtook humans in May and now carry close to two-thirds of the traffic. Three in the morning is rush hour, and every one of those checks is a question about meat.
The reflex is to get better at spotting the bots. I don’t buy it. Looking human was always the cheap part. An agent that can book your flights can click “I’m not a robot.”
So stop asking whether it’s meat. Ask what it can reach, and keep that small: one mailbox, not the tenant. Same rule for the intern, the agent, and the service account nobody looks at.
Pick one account that will never have a thumb. What can it reach? And who would notice if it did?
The dialogue is a nod to Terry Bisson’s short story “They’re Made out of Meat”. It takes three minutes to read and it aged suspiciously well.
The numbers come from Cloudflare Radar, via Mitch Wagner’s opinion piece at Fierce Network.
For the doers: export your service accounts and API keys, sort them by what they can reach, and start at the top. The one with tenant-wide rights and no owner is your first ticket.
Unlike the intern, it won’t complain about the review.