3 ms·

…given a web browser that is logged in as a google developer, of course

seanmcdirmid 4y ago
The web browser session must be authenticated. You can't just log on to your Googler machine and begin using the internal network with your browser. Gnubby must be satisfied.
- jeffbee 4y ago
  I mean it's likely that a process running as a user who is logged in interactively and fully authenticated and recently 2FA's could do something but that thing isn't going to be very spectacular. What would it do? Try to sneak a malicious change into another changelist? I am not saying this is completely useless but it would only be step 1 of many that are unlikely to all succeed and would need to be laser-targeted to the right engineer with the necessary code ownership.
  - 13of40 4y ago
    It's a perfect way for an APT to get a foothold in your environment. Imagine if you could check in a unit test that "downloads updates" from somewhere and executes them. Now you've got 30 devs on that floor running your arbitrary code without any paper trail. And since we (generalizing here, I know) have this culture of thinking test code is junk anyway, is anyone going to scrutinize it or just click "approve" and move onto the stuff they think is important?
    - jeffbee 4y ago
      That’s a good reason to execute your unit tests in an ephemeral environment without network access. All I am saying about the issues raised in the article is that some organizations start from the assumption that engineers will run arbitrary codes on their devices and the rest of their security story follows from that. It is not necessarily irrational. If you think that is crazy, it might be because you don’t understand the base assumptions.
    - seanmcdirmid 4y ago
      Unit tests don’t run on dev machines normally, you need to do something special to make that happen (which I’ve never done myself). Also, they by default run without external network access.

The web browser session must be authenticated. You can't just log on to your Googler machine and begin using the internal network with your browser. Gnubby must be satisfied.

jeffbee 4y ago
I mean it's likely that a process running as a user who is logged in interactively and fully authenticated and recently 2FA's could do something but that thing isn't going to be very spectacular. What would it do? Try to sneak a malicious change into another changelist? I am not saying this is completely useless but it would only be step 1 of many that are unlikely to all succeed and would need to be laser-targeted to the right engineer with the necessary code ownership.
- 13of40 4y ago
  It's a perfect way for an APT to get a foothold in your environment. Imagine if you could check in a unit test that "downloads updates" from somewhere and executes them. Now you've got 30 devs on that floor running your arbitrary code without any paper trail. And since we (generalizing here, I know) have this culture of thinking test code is junk anyway, is anyone going to scrutinize it or just click "approve" and move onto the stuff they think is important?
  - jeffbee 4y ago
    That’s a good reason to execute your unit tests in an ephemeral environment without network access. All I am saying about the issues raised in the article is that some organizations start from the assumption that engineers will run arbitrary codes on their devices and the rest of their security story follows from that. It is not necessarily irrational. If you think that is crazy, it might be because you don’t understand the base assumptions.
  - seanmcdirmid 4y ago
    Unit tests don’t run on dev machines normally, you need to do something special to make that happen (which I’ve never done myself). Also, they by default run without external network access.