22 ms·
Given the context, there's not a big difference between a website getting owned and an admin's browser getting owned. When someone develops an exploit that brea
by peterwwillis 9y ago
Given the context, there's not a big difference between a website getting owned and an admin's browser getting owned. When someone develops an exploit that breaks out of sandbox, they can do whatever they want.
Also, this assumes access to Tower is unlimited. ACLs applied in Tower should be able to limit what user has what access.
- lima 9y agoAll it takes is a compromised browser extension. Happens all the time: https://threatpost.com/seven-more-chrome-extensions-compromised/127458/ https://threatpost.com/seven-more-chrome-extensions-compromi...
- peterwwillis 9y agoAnd a compromised node.js dependency could own a non-browser-controlled install. But you don't have to use node.js apps, and you don't need to use browser extensions.
- lima 9y agoSure, but now you'll need to make sure noone in your company who has full access to Tower is using browser extensions. It's absolutely possible to use Ansible Tower securely, it just takes some effort.