4 ms·

My dev machine can't access prod data. My dev machine doesn't deploy to prod, the attack vector would be inserting malicious code, which would need to pass CR b

My dev machine can't access prod data. My dev machine doesn't deploy to prod, the attack vector would be inserting malicious code, which would need to pass CR before being compiled on a build server and then deployed to prod. In my case impact to the business would likely be less if my dev machine was compromised than if prod was. It'd depend on the dedication and skills of the attacker though.

theossuary 9y ago
I'm really curious if it's actually true your development machine can't pivot into prod. You don't have sufficient access on the build/ci/deploy servers to pivot into prod without code review? You don't have passwords saved/stored that are reused in critical/prod infrastructure? You have no way of accessing prod? That seems crazy to me, as I'm able to SSH into prod with a single command and password. I guess I'm further on the ops side, but still.
- XR0CSWV3h3kZWg 9y ago
  There is a pretty strong ops/dev divide where I work. There are some repos I have admin access to, those I could push malicious code directly, execute a build and authorize a push to production. Most products I work on have a fairly long build time and that'd be a fairly noisy process (emails sent off). It'd work if you are just trying to get a shell, but it'd assuredly alert someone that something bad is happening.
- derefr 9y ago
  Depends on what you mean by "development machine." My Macbook has those credentials on it, but the Ubuntu VM running on it, which I do most of my development within, does not. Personally, I wish more operating systems came with an installer checkbox for "this will be used as a VM within an environment that already has its own security mechanisms; stop doing anything related to security/multitenancy (i.e. automatic login, no sudo password, no screen lock, etc.) and just let the host handle all that." Every time I set up a development VM I have to go to a bit of trouble to create an environment almost-but-not-quite like that, thwarting all the carefully-designed-in, yet redundant, security. Makes me miss MS-DOS and Windows 3.1/95 a bit; those were truly "Personal Computer operating systems", in the sense that they assumed that there was a 1:1 correspondence between physical access to the hardware and the privilege to read/write/execute arbitrary data on said hardware. It'd be neat to have a version of Linux (or Windows 10) with that sort of "retro" security model (but still with process sandboxing; just because any user has rights, doesn't mean any program should, because programs aren't always the authorized agents of a user's will.)
  - stephenr 9y ago
    Wait, youre using a vm for dev, using the vm GUI/desktop environment? Either way, it sounds like Vagrant may help. Most baseboxes target headless server dev and don't have a DE but a few do, and of course you can build your own base box and then customise via a provisioner for each different project.
- yjftsjthsd-h 9y ago
  > I'm able to SSH into prod with a single command and password. Password? Are you not using keys?
  - AstralStorm 9y ago
    If you have a passwordless key, you're nullifying half of the security. Yes yes, ubikeys or smartcards exist... but it is the same second factor: what you have. Password is what you know. Biometrics theoretically are what you are but really what you have on yourself.
    - theossuary 9y ago
      Yeah, passwordless keys suck, I agree. It's a little better because my hard disk is encrypted, but still not enough. I just got my Yubikey in the mail, and I want to move everything to Yubikey (for GPG) & an SSH agent, then I can redo all my keys; but I'm dragging my feet a little

theossuary 9y ago

I'm really curious if it's actually true your development machine can't pivot into prod. You don't have sufficient access on the build/ci/deploy servers to pivot into prod without code review? You don't have passwords saved/stored that are reused in critical/prod infrastructure? You have no way of accessing prod? That seems crazy to me, as I'm able to SSH into prod with a single command and password. I guess I'm further on the ops side, but still.

XR0CSWV3h3kZWg 9y ago
There is a pretty strong ops/dev divide where I work. There are some repos I have admin access to, those I could push malicious code directly, execute a build and authorize a push to production. Most products I work on have a fairly long build time and that'd be a fairly noisy process (emails sent off). It'd work if you are just trying to get a shell, but it'd assuredly alert someone that something bad is happening.
derefr 9y ago
Depends on what you mean by "development machine." My Macbook has those credentials on it, but the Ubuntu VM running on it, which I do most of my development within, does not. Personally, I wish more operating systems came with an installer checkbox for "this will be used as a VM within an environment that already has its own security mechanisms; stop doing anything related to security/multitenancy (i.e. automatic login, no sudo password, no screen lock, etc.) and just let the host handle all that." Every time I set up a development VM I have to go to a bit of trouble to create an environment almost-but-not-quite like that, thwarting all the carefully-designed-in, yet redundant, security. Makes me miss MS-DOS and Windows 3.1/95 a bit; those were truly "Personal Computer operating systems", in the sense that they assumed that there was a 1:1 correspondence between physical access to the hardware and the privilege to read/write/execute arbitrary data on said hardware. It'd be neat to have a version of Linux (or Windows 10) with that sort of "retro" security model (but still with process sandboxing; just because any user has rights, doesn't mean any program should, because programs aren't always the authorized agents of a user's will.)
- stephenr 9y ago
  Wait, youre using a vm for dev, using the vm GUI/desktop environment? Either way, it sounds like Vagrant may help. Most baseboxes target headless server dev and don't have a DE but a few do, and of course you can build your own base box and then customise via a provisioner for each different project.
yjftsjthsd-h 9y ago
> I'm able to SSH into prod with a single command and password. Password? Are you not using keys?
- AstralStorm 9y ago
  If you have a passwordless key, you're nullifying half of the security. Yes yes, ubikeys or smartcards exist... but it is the same second factor: what you have. Password is what you know. Biometrics theoretically are what you are but really what you have on yourself.
  - theossuary 9y ago
    Yeah, passwordless keys suck, I agree. It's a little better because my hard disk is encrypted, but still not enough. I just got my Yubikey in the mail, and I want to move everything to Yubikey (for GPG) & an SSH agent, then I can redo all my keys; but I'm dragging my feet a little