3 ms·
I work mostly on Infra / DevOps. I'm constantly amazed by the absurdly low standards most devs have when it comes to security. The path of least resistance is c
by totallywrong 3y ago
I work mostly on Infra / DevOps. I'm constantly amazed by the absurdly low standards most devs have when it comes to security. The path of least resistance is chosen 99% of time. You're definitely the exception.
- mejutoco 3y agoIMO often this just reflects the priorities of the organization. While it is the responsibility of devs, some system needs to be put in place to actually enforce it. Like, do not have an nfs shared volume, or incentivise anybody to report these, and give incentives for it. Otherwise "just be very careful" advice slows development to a halt.
- totallywrong 3y agoI only half agree. Of course the company needs to have processes in place. But having shared storage can serve a multitude of legit purposes, and I feel like some alarm should go off in a developer's mind when he thinks of just dumping secrets there. Or the next one who comes and use them. Or you might not have shared storage, and then they'll just put the creds in a Google spreadsheet like I've seen very recently.