4 ms·

I personally like the idea of a secure gate - devs can do what they want, but checkin gateways require someone on a trusted machine to review code. Obviously d

I personally like the idea of a secure gate - devs can do what they want, but checkin gateways require someone on a trusted machine to review code. Obviously dev machines cannot touch prod / don’t have access to corporate resources etc. This is a model I like, but it may not fit everyone’s view of security, so please consider your personal requirements before building on this.

gpm 4y ago
This is how I've always imagined that I would design a high security system. I've never seen it done in practice though, have you?
- hsbauauvhabzb 4y ago
  No. I plan on using it myself, but have not yet implemented it.
pixl97 4y ago
Most larger companies already have some type of code gate like this where dev checks in software and it's exposed to automated testing then review. But as you state there are many security models in which the dev machines still need to ensure you cannot leak code out of the company confines. In many financial industries leaking code between different teams can be/is considered a security risk.
- hsbauauvhabzb 4y ago
  How would you navigate ‘but I need $x.exe’? Dont get me wrong I’d love to say lolno to these types of requests, but basically everything requires npm these days, while also being basically impossible to audit every dependency you install. I’m a huge fan of good security shouldn’t impact too much on productivity, but dependency trees make me lose sleep at night (waterhole attacks, EOL packages that are painful to remove, etc). Pentester by trade with a background in software dev.
  - pixl97 4y ago
    The same way any business deals with any need. The requestor must make a business case for the need that is then reviewed. I need $x.exe is not just a security risk, it's a business continuity risk. What is the licensing of $X, do we need to pay licensing for it? Are we getting sued for using it? Are we doing to redistribute it, and can we? In general the average programmer, especially on a team should not be making that choice, and someone higher up should before really expensive surprises happen. I work in software composition analysis/static analysis/SBOM and ya, the average piece of software coming can be terrifying. Its common to see companies distributing things like open source packages in violation of the license. Even worse is when they are pulling in something like 'One-Js' and '0ne-Js' (made up for example) that shows up in audit of our SCA output.

gpm 4y ago

This is how I've always imagined that I would design a high security system. I've never seen it done in practice though, have you?

hsbauauvhabzb 4y ago
No. I plan on using it myself, but have not yet implemented it.

pixl97 4y ago

Most larger companies already have some type of code gate like this where dev checks in software and it's exposed to automated testing then review. But as you state there are many security models in which the dev machines still need to ensure you cannot leak code out of the company confines. In many financial industries leaking code between different teams can be/is considered a security risk.

hsbauauvhabzb 4y ago
How would you navigate ‘but I need $x.exe’? Dont get me wrong I’d love to say lolno to these types of requests, but basically everything requires npm these days, while also being basically impossible to audit every dependency you install. I’m a huge fan of good security shouldn’t impact too much on productivity, but dependency trees make me lose sleep at night (waterhole attacks, EOL packages that are painful to remove, etc). Pentester by trade with a background in software dev.
- pixl97 4y ago
  The same way any business deals with any need. The requestor must make a business case for the need that is then reviewed. I need $x.exe is not just a security risk, it's a business continuity risk. What is the licensing of $X, do we need to pay licensing for it? Are we getting sued for using it? Are we doing to redistribute it, and can we? In general the average programmer, especially on a team should not be making that choice, and someone higher up should before really expensive surprises happen. I work in software composition analysis/static analysis/SBOM and ya, the average piece of software coming can be terrifying. Its common to see companies distributing things like open source packages in violation of the license. Even worse is when they are pulling in something like 'One-Js' and '0ne-Js' (made up for example) that shows up in audit of our SCA output.