4 ms·
This.. AND… dev machines should be isolated environments via something like GitHub Codespaces, local docker containers or Google’s IDX. You also shouldn’t be a
by mdhb 2y ago
This.. AND… dev machines should be isolated environments via something like GitHub Codespaces, local docker containers or Google’s IDX.
You also shouldn’t be able to push code directly to anywhere other than a centralized repository. All the build stuff should happen in a dedicated and independent process.
From a security point of view you need to accept that the idea of running into a malicious package as a direct or indirect dependency is not only not zero but fairly realistic and you should try to limit the blast radius as much as possible for when that does happen.
- nottorp 2y agoJust air gap the dev machines. But an attacker could infiltrate them by manipulating magnetic fields to generate keystrokes / mouse moves so also faraday cage them.
- mdhb 2y agoI don’t know why you’re trying to make this some kind of gotcha. What I said was absolutely 100% standard security advice. You’re just making yourself look silly here.