4 ms·
Doesn’t Google use a monorepo though? Even if there are guards against poisoning builds and commits, the risk of an RCE causing silent exfiltration of confident
by btown 4y ago
Doesn’t Google use a monorepo though? Even if there are guards against poisoning builds and commits, the risk of an RCE causing silent exfiltration of confidential trade secrets must be astronomical.
- saagarjha 4y agoGoogle doesn’t really seem to be able to prevent this; instead they monitor to see what ended up leaked.
- UncleMeat 4y agoIncredibly sensitive portions of google3 are siloed and only a small part of the company can access them. Tools like code search and the source checkout process also both check for accessing unusually large portions of the codebase, making it only possible to exfiltrate small portions of the codebase at once.
- deleted 4y ago[deleted]