3 ms·

How do people rationalize using a service like this for anything other than toy projects? Sending your source code to some service, then adopting and executing

How do people rationalize using a service like this for anything other than toy projects? Sending your source code to some service, then adopting and executing the artifacts it produces, means this is the central, most critical aspect of your security story. For real projects it doesn't stand even a moment's scrutiny.

solardev 3y ago
A lot of smaller teams/companies don't really care about security, sadly... and is this really that different from Github Actions, CircleCI, Vercel, anything...?
- yjftsjthsd-h 3y ago
  It has the difference of not having been around for as long and accruing reputation. That's nothing inherent, and will come with time of course. Of those, the only other difference is that github actions has the advantage of being first party; if you use github, then there's no increase in security exposure by using their own actions.
  - solardev 3y ago
    That's fair!
switchbak 3y ago
In this world of SaaS, we're already sharing many of our crown jewels with other services anyway. Hosted DB's, auth services - this is just another in a long line. Some might say that data is more important than a snapshot of the code anyway (depends on the domain). Call me old school, but I'm with you. A vendor would have to be exceptionally well regarded over a long time to get my trust in such a scenario.
- jeffbee 3y ago
  It's easier to imagine that Microsoft isn't going to monkey with your private data, and that they in all likelihood have a 24x7 security team actively prowling around looking for intruders. But a fly-by-night outfit has no reputation at stake and probably has no ability to realize that their whole junk has been pwned by Chinese intelligence or whomever.
Sytten 3y ago
I am not sure I see the problem. There is a business with a reputation behind that service. There is a contract and it no different than a contract with another provider like GitHub. Who are you to judge "real projects" BTW? It might not suit your security profile, but it might for other businesses that have different security concerns.

solardev 3y ago

A lot of smaller teams/companies don't really care about security, sadly... and is this really that different from Github Actions, CircleCI, Vercel, anything...?

yjftsjthsd-h 3y ago
It has the difference of not having been around for as long and accruing reputation. That's nothing inherent, and will come with time of course. Of those, the only other difference is that github actions has the advantage of being first party; if you use github, then there's no increase in security exposure by using their own actions.
- solardev 3y ago
  That's fair!

switchbak 3y ago

In this world of SaaS, we're already sharing many of our crown jewels with other services anyway. Hosted DB's, auth services - this is just another in a long line. Some might say that data is more important than a snapshot of the code anyway (depends on the domain). Call me old school, but I'm with you. A vendor would have to be exceptionally well regarded over a long time to get my trust in such a scenario.

jeffbee 3y ago
It's easier to imagine that Microsoft isn't going to monkey with your private data, and that they in all likelihood have a 24x7 security team actively prowling around looking for intruders. But a fly-by-night outfit has no reputation at stake and probably has no ability to realize that their whole junk has been pwned by Chinese intelligence or whomever.

Sytten 3y ago

I am not sure I see the problem. There is a business with a reputation behind that service. There is a contract and it no different than a contract with another provider like GitHub. Who are you to judge "real projects" BTW? It might not suit your security profile, but it might for other businesses that have different security concerns.