Keep a signed remote switch for each risky feature

How to do it

When a hole is found in remote unlocking or video streaming, turning the feature off within minutes buys time until the fix ships. Send switches as signed messages with an expiry time, so a replayed old message does nothing. A switch never turns off a safety function, such as a smoke alarm's sound or a lock's manual key. Record every flip with the person and the reason, as with any production change. Web apps use feature flags in the same way, as in read feature flags before the first paint.

Examples

Python example

import json
import time

def apply_switch(message: bytes, signature: bytes, public_key, features) -> bool:
    public_key.verify(signature, message)
    switch = json.loads(message)
    if switch["expires_at"] < time.time() or switch["feature"] in features.safety_functions:
        return False
    features.set_enabled(switch["feature"], switch["enabled"])
    return True

Go example

func ApplySwitch(message, signature []byte, publicKey ed25519.PublicKey, features Features) (bool, error) {
	if !ed25519.Verify(publicKey, message, signature) {
		return false, errors.New("switch signature does not match")
	}
	var s Switch
	if err := json.Unmarshal(message, &s); err != nil {
		return false, err
	}
	if time.Now().Unix() > s.ExpiresAt || features.IsSafetyFunction(s.Feature) {
		return false, nil
	}
	features.SetEnabled(s.Feature, s.Enabled)
	return true, nil
}

How to check

A test flips a switch for a test group, and every device there turns the feature off within 5 minutes. An unsigned switch message, and a signed one past its expiry, are both ignored.

Related rules

• CMP-36 Prove every production change was reviewed in Compliance and governance
• APP-49 Read feature flags before the first paint in Web app interface