4 ms·
> As a developer … most of our internal development sites are http only. As a developer, should you not work against an environment closer to production behavi
by dspillett 6y ago
> As a developer … most of our internal development sites are http only.
As a developer, should you not work against an environment closer to production behaviours? Otherwise you might miss performance issues (due to different caching behaviours between http/https) or other problems until your code is released.
- nickik 6y agoIts not always the code you work on. It might be other internal services or sites.
- dspillett 6y agoAll our internal services are HTTPS. Then if a new hack is found to weaken wireless protocols we have that extra line of protection. Security in depth. We serve strongly regulated industries and are subject to in-depth audits by clients on occasion, so perhaps my level of paranoia would be less warranted elsewhere. I'd still HTTPS everything though, even if the potential payoff is small because the required effort is too.
- iso1631 6y agopublic certificates? Do you use wildcards, or are you unconcerned by leaking information like servernames via CT?
- dspillett 6y agoPublic wildcard cert for centrally managed things. Of course only a trusted few have access to the private parts of the certificate that covers centrally managed things. For local dev instances I suggest having a local only meaningless domain and a wildcard off that, If we were using per name certs and name leaking were a significant issue we could instead sign with a local CA and push the signing cert out as trusted to all machines we manage.