5 ms·

I don't think so. Software running on your computer has wholesale access to your filesystem. If those files are accessible only via the web (or if you bother s

I don't think so. Software running on your computer has wholesale access to your filesystem. If those files are accessible only via the web (or if you bother setting up ssh + pubkey, via ssh) that significantly reduces the surface area of possible attacks. Don't hate on "not being impossible" for "being less likely."

marcosdumay 5y ago
"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You can claim it becomes "harder", what it does, a very small bit that doesn't warrant anything like the claims on the GP. All it changes is that the attacker will have to launch the browser or rewrite some part of it (what he can do, because the browser auto-updates with your access level), instead of simply taking the files. Oh, and by the way, not all software running on your machine has complete access to the filesystem. Reading your code and changing your browser requires basically the same level of access.
- jordemort 5y ago
  I stand behind the idea that forcing everything through SSH to a VM they control or over HTTPS to a web app they control has meaningful security advantages. Of course you can craft a hostile client for any service, but it adds a barrier (and a place to run countermeasures) that wasn't there before. It definitely lessens the likelihood of getting caught up by some dumb untargeted drive-by malware, at least. Also, do keep in mind the target audience for Microsoft's enterprise products - if something lets you check off a bunch of boxes on some government or industry compliance checklist, then that thing has value to those customers, regardless of any actual security benefit.
  - jordemort 5y ago
    The idea w/ the VM being that you could run all sorts of heavy anti-malware and pattern detection and file access analysis type of stuff ala CarbonBlack w/o having to manage deploying it to all your workstations and making sure it stays updated and functional there.
- deleted 5y ago
  [deleted]
- blueplanet200 5y ago
  >"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You have N machines, M developers, with access to the internet and development environment E. What are the chances of someone stealing your code given N, M, and E. Changes to N, M, and E change your expectation on the frequency and severity of attacks.
deleted 5y ago
[deleted]

marcosdumay 5y ago

"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You can claim it becomes "harder", what it does, a very small bit that doesn't warrant anything like the claims on the GP. All it changes is that the attacker will have to launch the browser or rewrite some part of it (what he can do, because the browser auto-updates with your access level), instead of simply taking the files. Oh, and by the way, not all software running on your machine has complete access to the filesystem. Reading your code and changing your browser requires basically the same level of access.

jordemort 5y ago
I stand behind the idea that forcing everything through SSH to a VM they control or over HTTPS to a web app they control has meaningful security advantages. Of course you can craft a hostile client for any service, but it adds a barrier (and a place to run countermeasures) that wasn't there before. It definitely lessens the likelihood of getting caught up by some dumb untargeted drive-by malware, at least. Also, do keep in mind the target audience for Microsoft's enterprise products - if something lets you check off a bunch of boxes on some government or industry compliance checklist, then that thing has value to those customers, regardless of any actual security benefit.
- jordemort 5y ago
  The idea w/ the VM being that you could run all sorts of heavy anti-malware and pattern detection and file access analysis type of stuff ala CarbonBlack w/o having to manage deploying it to all your workstations and making sure it stays updated and functional there.
deleted 5y ago
[deleted]
blueplanet200 5y ago
>"Less likely" applies to random events. Sabotaging or stealing code has nothing of random in it. You have N machines, M developers, with access to the internet and development environment E. What are the chances of someone stealing your code given N, M, and E. Changes to N, M, and E change your expectation on the frequency and severity of attacks.

deleted 5y ago

[deleted]