4 ms·
Having been the first 'DevOps' guy to hit the ground in a few startups I have seen interesting deployment and access strategies to databases PHP exec("echo $mys
by cannonpr 10y ago
Having been the first 'DevOps' guy to hit the ground in a few startups I have seen interesting deployment and access strategies to databases PHP exec("echo $mysql_query | mysql -uadmin -ppassword"); is probably my favourite.
For a lot of frontend or fullstack teams, the business shouting, get it done, trumps any damage they might take by a compromise. Also often they are just not aware of how insecure the defaults are, I feel like a lot more can be done to provide secure out of the box stacks for 'full stack' developers.
- paulddraper 10y agoProbably. Feel free to provide concrete examples. --- FYI, there isn't a security vulnerability in that wretched example... just WTFibility. (I'm assuming shell escaping...else virtually every query wouldn't work.)
- technion 10y agoI'm staring down the barrel of a startup that "deploys" using an Internet accessible, passwordless Samba share to drag and drop PHP files from desktops to production. Nothing surprises me.