3 ms·
We use BitBucket here, rather than Github - similar risks, I know, but we have predetermined repositories which are all set as private. 3 dev machines which ar
by cyberferret 10y ago
We use BitBucket here, rather than Github - similar risks, I know, but we have predetermined repositories which are all set as private. 3 dev machines which are kept on premises at all times.
Still not optimal as far as security goes, but it seems that he have roughly the same exposure if AWS leaks our keys and passwords to other third party trackers...
- Ixiaus 10y agoUse kms and dynamodb with key enveloping, or this tool: https://github.com/fugue/credstash https://github.com/fugue/credstash Don't initialize into env vars and don't store in repos, even private ones.
- cyberferret 10y agoThanks - sounds like a good solution. I will look into this in detail over the weekend.
- fletchowns 10y agoBe careful when modifying user access to a private BitBucket repository. Their autosuggest for the username input field will show all bitbucket users. Makes it incredibly easy to accidentally grant somebody outside of your organization access to a repository.
- iampims 10y agoI can attest to that. I have the username "tim" on bitbucket and get added to private repos all the time by mistake.
- fletchowns 10y agoOn top of that, there's no audit history of who has had access to a repository. Absolutely ridiculous.