4 ms·
Any reason why a financial infrastructure provider like Stripe would run CI tests on someone elses infrastructure? Isn't that a no go from a security point of v
by chinathrow 11y ago
Any reason why a financial infrastructure provider like Stripe would run CI tests on someone elses infrastructure? Isn't that a no go from a security point of view? Or - how do you trust the hosted CI company not to look at your code?
- patio11 11y agohow do you trust the hosted CI company not to look at your code? Contracts, not firewalls, make the world go round.
- scrollaway 11y agoTo be fair a contract does not guarantee the security framework of the company you are contracting, which means your code is only as safe as their weakest link.
- NeutronBoy 11y agoWhich is why contracts include things like right-to-audit, so you can verify for yourself.
- inopinatus 11y agoCan't upvote this hard enough. It's a classic conceit of secops people that they are the only line of defence against unscrupulous behaviour. Systemic pathologies follow from this misbelief. c.f. also: "Enterprise Architects", a group of people who think building IT systems qualifies you to redesign an entire organisation.
- brown9-2 11y agohow do you trust the hosted CI company not to look at your code One can probably assume that they are not relying upon the secrecy of their code for security.
- hawkice 11y agoThere are other reasons to keep code proprietary than fearing a security failure in the event the code leaks.
- chinathrow 11y agoYes - I think their fraud detection code might be worth some $$$ if sold to the right folks.
- jwatte 11y agoIf their code is right, everyone in the world reading it wouldn't be a problem.