3 ms·
Which one of their tools are we talking about here? Terraform?
by RRRA 9y ago
Which one of their tools are we talking about here? Terraform?
- syscomet 9y agoblog-post author here: all of them written in Golang which use SSH. Packer, Terraform, Vault, all of them. Using a bastion host in your configurations doesn't help if you invoke the tooling on your laptop, since the connection to the bastion host is done with the SSH package, again with no host-key verification.
- Piphe 9y agoAnd Vault is supposed to be a super secure root of trust. Hmm...
- canes123456 9y agoDamn, I was planning on using Vault eventually. This attitude towards security gives me pause about put all my secrets into it. Is there any alternatives?
- mitchellh 9y agoI posted the exact affected software (and how) here: https://news.ycombinator.com/item?id=14122973 https://news.ycombinator.com/item?id=14122973 I go into detail so I'd rather not repeat it here :)