3 ms·
My point specifically is that by increasing build and deployment security. You actually are decreasing the amount of people who can potentially review and audit
by Arelius 7y ago
My point specifically is that by increasing build and deployment security. You actually are decreasing the amount of people who can potentially review and audit the build. Thus making it more likely that someone in power could introduce a backdoor that nobody else in the large org knows about.
- asdfasgasdgasdg 7y agoI don't think that's true? Increasing build security is about limited the number of folks who can modify the process. That's orthogonal to auditability.
- Arelius 7y agoFair Point. It is orthogonal, but it is often correlated in practice. Quite often permission systems to prevent modification are also used to prevent visibility. I'd also say it's not completely unrelated. Let's consider a hidden build machine process. Once you've hidden that, preventing modifications to the build process by people "not in the know" makes it much less likely that said process can be discovered (either on purpose or accident) If everyone can and does have full access to those build machines it increases the likelihood that someone making a modification could run into said process.