4 ms·

I think what we will (need) to see in coming time is more security awareness wrt. development tooling and setup. Like: - always run all dev tools in a sandbox

I think what we will (need) to see in coming time is more security awareness wrt. development tooling and setup. Like: - always run all dev tools in a sandbox, including the compiler and language server - proper secure (harden) developer systems - don't install software outside of sandboxes which is known to be often less careful with security vulnerabilities, like steam (or games in general). Firewalls can help wrt. offline only games, but due to things like drm, invites, game updates etc. most modern game software is not offline only. - split CI into components, make sure the part which builds (and potential deploys) artifacts doesn't run in the same sandbox as additional analysis tools. Potentially run different analysis tools in different sandboxes. Don't give CI sandboxes permissions to directly push to your repository etc. If a tool need to be able to push to git consider limiting it's access to a specific folder or if not possible sub-module (which tbh. are annoying). - Limit internet access of CI sandboxes as far as possible. Sadly some of this things are quite cumbersome or even impossible to setup with (at least non enterprise) github.

mschuster91 6y ago
> Sadly some of this things are quite cumbersome or even impossible to setup with (at least non enterprise) github. All of this can be set up in-house with open source tooling, there really is no excuse. Gitlab CI with your own runners that are forbidden from direct Internet access, Sonatype's Nexus to proxy Docker images, Debian/Ubuntu APT, NPM and Maven repositories, and stuff like Sonarqube on Docker containers with a no-internet configuration. For stuff that absolutely needs Internet access (PHPs Composer comes to mind, sigh), set up a caching Squid instance. You don't even need VMs for that any more, a single machine with Docker running is enough.
- movedx 6y ago
  > Gitlab CI with your own runners that are forbidden from direct Internet access Yes. Absolutely yes. GitLab (CI) is SO. GOOD. Use it! It's incredibly flexible and powerful.
  - mschuster91 6y ago
    I agree, but it has a couple of annoyances. - One thing I'm missing to ditch Jenkins permanently is general purpose job stuff... like "synchronize the production database to integration". Yes there are workarounds but all of them are ugly. - Developing pipelines in Gitlab CI is tedious at best. With Jenkins I don't need to switch between applications during development, with Gitlab I need to switch between browser (to see logs), command line (git) and an editor for the pipeline. - Holy hell it's dog slow sometimes. A runner with Docker executors always builds a whole new instance for each goddamn step of the pipeline, ALWAYS. Jenkins is intelligent enough to re-purpose executors.
    - yjftsjthsd-h 6y ago
      > Gitlab I need to switch between browser (to see logs), command line (git) and an editor for the pipeline. Fwiw, you can do it all in-browser with gitlab's editor.
    - tpxl 6y ago
      > - One thing I'm missing to ditch Jenkins permanently is general purpose job stuff... like "synchronize the production database to integration". Yes there are workarounds but all of them are ugly. We had a job that backed up some data to a git repo and the gitlab ci cronjobs were really easy to use. It was a simple java -jar, git pull, git commit, git push script and tbh it couldn't have been simpler.
    - KptMarchewa 6y ago
      >One thing I'm missing to ditch Jenkins permanently is general purpose job stuff... like "synchronize the production database to integration". Yes there are workarounds but all of them are ugly. Oh, I have a wonderful setup consisting of just 30 different tools. Let's start with proper Kubernetes cluster...
- galangalalgol 6y ago
  Nexus doesn't have proxy plugins for a lot of popular repositories. In looking at finishing the one for crates.io that is out there I got the impression that Nexus was kind of a dumpster fire. We decided to air gap our dev network instead and mirror stuff devs need, updating at regular intervals. Mostly works. Haven't figured out how to mirror crates.io but it is supposed to be possible. Julia seems like it might not be.
  - mschuster91 6y ago
    One of the prices to pay for choosing an exotic stack, I'd say. How are your developers able to do any work in an airgapped network? I'd hand in my papers if I were not able to use Google on my development machine.
    - galangalalgol 6y ago
      Rust isn't that exotic anymore, or did you meann air gapping? That is getting more common too due to events like this. There were some efforts to mirror stuff like stack overflow, but eventually they gave all the devs internet facing machines for research. No copy paste, just paraphrase, which is probably better. Software requests are handled quite promptly which helps.
- RamblingCTO 6y ago
  > All of this can be set up in-house with open source tooling, there really is no excuse. You use cloud services because they don't cost so much time and have a fixed amount of money (normally) that you can sink into. Also, there are people who fix the problems with the product. You can't just do everything on your own if you want to focus on your product.
goatinaboat 6y ago
I think what we will (need) to see in coming time is more security awareness wrt. development tooling and setup. Management at a former employer quite rightly freaked out when they realised that their devs on a certain subcontinent were routinely pasting their code into external web-based prettifiers to format it nicely...
- thinkharderdev 6y ago
  Ha. I bet if you were so inclined you could harvest a gold mine of sensitive information by having a public website which did: 1. JSON prettifying 2. JWT decoding/verification (bonus for "paste your signing key and we will generate JWTs for you too!") 3. PEM <-> DER conversion
  - cddotdotslash 6y ago
    The amount of valid JWTs that jwt.io could have harvested by this point is incredible to even consider.
  - nerdponx 6y ago
    As per my sibling comment - we need easier/better CLI and/or offline GUI tools for simple stuff like this.
    - thinkharderdev 6y ago
      Yeah, I use bloop personally which is great for this stuff.
      - nerdponx 6y ago
        I've never heard of it. Is there a webpage or source repo?
        thinkharderdev 6y ago
        Sorry, it's boop not bloop. Source is at https://github.com/IvanMathy/Boop https://github.com/IvanMathy/Boop

mschuster91 6y ago

> Sadly some of this things are quite cumbersome or even impossible to setup with (at least non enterprise) github. All of this can be set up in-house with open source tooling, there really is no excuse. Gitlab CI with your own runners that are forbidden from direct Internet access, Sonatype's Nexus to proxy Docker images, Debian/Ubuntu APT, NPM and Maven repositories, and stuff like Sonarqube on Docker containers with a no-internet configuration. For stuff that absolutely needs Internet access (PHPs Composer comes to mind, sigh), set up a caching Squid instance. You don't even need VMs for that any more, a single machine with Docker running is enough.

movedx 6y ago
> Gitlab CI with your own runners that are forbidden from direct Internet access Yes. Absolutely yes. GitLab (CI) is SO. GOOD. Use it! It's incredibly flexible and powerful.
- mschuster91 6y ago
  I agree, but it has a couple of annoyances. - One thing I'm missing to ditch Jenkins permanently is general purpose job stuff... like "synchronize the production database to integration". Yes there are workarounds but all of them are ugly. - Developing pipelines in Gitlab CI is tedious at best. With Jenkins I don't need to switch between applications during development, with Gitlab I need to switch between browser (to see logs), command line (git) and an editor for the pipeline. - Holy hell it's dog slow sometimes. A runner with Docker executors always builds a whole new instance for each goddamn step of the pipeline, ALWAYS. Jenkins is intelligent enough to re-purpose executors.
  - yjftsjthsd-h 6y ago
    > Gitlab I need to switch between browser (to see logs), command line (git) and an editor for the pipeline. Fwiw, you can do it all in-browser with gitlab's editor.
  - tpxl 6y ago
    > - One thing I'm missing to ditch Jenkins permanently is general purpose job stuff... like "synchronize the production database to integration". Yes there are workarounds but all of them are ugly. We had a job that backed up some data to a git repo and the gitlab ci cronjobs were really easy to use. It was a simple java -jar, git pull, git commit, git push script and tbh it couldn't have been simpler.
  - KptMarchewa 6y ago
    >One thing I'm missing to ditch Jenkins permanently is general purpose job stuff... like "synchronize the production database to integration". Yes there are workarounds but all of them are ugly. Oh, I have a wonderful setup consisting of just 30 different tools. Let's start with proper Kubernetes cluster...
galangalalgol 6y ago
Nexus doesn't have proxy plugins for a lot of popular repositories. In looking at finishing the one for crates.io that is out there I got the impression that Nexus was kind of a dumpster fire. We decided to air gap our dev network instead and mirror stuff devs need, updating at regular intervals. Mostly works. Haven't figured out how to mirror crates.io but it is supposed to be possible. Julia seems like it might not be.
- mschuster91 6y ago
  One of the prices to pay for choosing an exotic stack, I'd say. How are your developers able to do any work in an airgapped network? I'd hand in my papers if I were not able to use Google on my development machine.
  - galangalalgol 6y ago
    Rust isn't that exotic anymore, or did you meann air gapping? That is getting more common too due to events like this. There were some efforts to mirror stuff like stack overflow, but eventually they gave all the devs internet facing machines for research. No copy paste, just paraphrase, which is probably better. Software requests are handled quite promptly which helps.
RamblingCTO 6y ago
> All of this can be set up in-house with open source tooling, there really is no excuse. You use cloud services because they don't cost so much time and have a fixed amount of money (normally) that you can sink into. Also, there are people who fix the problems with the product. You can't just do everything on your own if you want to focus on your product.

goatinaboat 6y ago

I think what we will (need) to see in coming time is more security awareness wrt. development tooling and setup. Management at a former employer quite rightly freaked out when they realised that their devs on a certain subcontinent were routinely pasting their code into external web-based prettifiers to format it nicely...

thinkharderdev 6y ago
Ha. I bet if you were so inclined you could harvest a gold mine of sensitive information by having a public website which did: 1. JSON prettifying 2. JWT decoding/verification (bonus for "paste your signing key and we will generate JWTs for you too!") 3. PEM <-> DER conversion
- cddotdotslash 6y ago
  The amount of valid JWTs that jwt.io could have harvested by this point is incredible to even consider.
- nerdponx 6y ago
  As per my sibling comment - we need easier/better CLI and/or offline GUI tools for simple stuff like this.
  - thinkharderdev 6y ago
    Yeah, I use bloop personally which is great for this stuff.
    - nerdponx 6y ago
      I've never heard of it. Is there a webpage or source repo?
      - thinkharderdev 6y ago
        Sorry, it's boop not bloop. Source is at https://github.com/IvanMathy/Boop https://github.com/IvanMathy/Boop