4 ms·

CI/CD servers, dev laptops etc could have more privileges than the production machines. For instance.

iudqnolq 4y ago
So you never run tests on your dev machine or CI/CD, and never run your code to manually test? I'm not experienced but I thought it was normal to have some way to try out what you've written on your dev machine. Is everyone else stepping through code in their head only, and their code is run for the first time when it's deployed to production?
- mlyle 4y ago
  Your dev machine getting pwned is bad, but your CI server getting screwed up is worse. This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. (As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad).
  - iudqnolq 4y ago
    > This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. If this is now only helping CI and not dev machines I don't see why it's worth the effort. Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? > if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad I guess? I can't think of a single time in my life where this would have practically helped me. I skim dependencies on GitHub for obvious red flags and then trust them. I assume places with the resources to do actual in-depth review can disable advanced analysis in their IDEs for that.
    - brundolf 4y ago
      You're digging in really hard trying to talk someone out of following good development practices because you don't personally think his effort is worth it. Personally, I don't think the effort being put into this argument is worth it.
    - mlyle 4y ago
      > Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? Not really. The compiler has to be able to access large swaths of your code. You want to e.g. keep your code safe. You would have to have very finely-grained sandboxing to prevent substantive disclosure, and even then you're likely leaking information.
  - pletnes 4y ago
    Fancy IDEs perform code analysis and thus if you feed them something malicious I guess it’s feasible to run a shell command or similar. By definition, IDEs have to do that to compile code, run linters etc.

So you never run tests on your dev machine or CI/CD, and never run your code to manually test? I'm not experienced but I thought it was normal to have some way to try out what you've written on your dev machine. Is everyone else stepping through code in their head only, and their code is run for the first time when it's deployed to production?

mlyle 4y ago
Your dev machine getting pwned is bad, but your CI server getting screwed up is worse. This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. (As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad).
- iudqnolq 4y ago
  > This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution. If this is now only helping CI and not dev machines I don't see why it's worth the effort. Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? > if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad I guess? I can't think of a single time in my life where this would have practically helped me. I skim dependencies on GitHub for obvious red flags and then trust them. I assume places with the resources to do actual in-depth review can disable advanced analysis in their IDEs for that.
  - brundolf 4y ago
    You're digging in really hard trying to talk someone out of following good development practices because you don't personally think his effort is worth it. Personally, I don't think the effort being put into this argument is worth it.
  - mlyle 4y ago
    > Wouldn't it be much simpler and more reliable to just sandbox compilation of anything in your CI? Not really. The compiler has to be able to access large swaths of your code. You want to e.g. keep your code safe. You would have to have very finely-grained sandboxing to prevent substantive disclosure, and even then you're likely leaking information.
- pletnes 4y ago
  Fancy IDEs perform code analysis and thus if you feed them something malicious I guess it’s feasible to run a shell command or similar. By definition, IDEs have to do that to compile code, run linters etc.