3 ms·
Great question. AWS secrets and Hashicorp Vault have both been audited by a plethora of agencies (and have passed). GitHub code for someone's pet project very l
by 1970-01-01 2y ago
Great question. AWS secrets and Hashicorp Vault have both been audited by a plethora of agencies (and have passed). GitHub code for someone's pet project very likely isn't going to pass any of those audits. When something goes wrong in prod, are you going to point your copy of 'some JS code that someone put on the Internet' and still have a job?
https://docs.aws.amazon.com/secretsmanager/latest/userguide/secretsmanager-compliance.html#:~:text=AWS%20Secrets%20Manager%20has%20undergone%20auditing%20for%20the%20following%20standards%20and%20can%20be%20part%20of%20your%20solution%20when%20you%20need%20to%20obtain%20compliance%20certification. https://docs.aws.amazon.com/secretsmanager/latest/userguide/...
https://www.hashicorp.com/trust/compliance/vault https://www.hashicorp.com/trust/compliance/vault
- bagels 2y agoYeah, many probably wouldn't get fired for that, but small consolation for a breach.
- scott_w 2y agoThe very fact it was audited massively reduces the chances it’ll be breached compared to a random JS file that hasn’t been seriously audited. A “please read and tell me the problems” is NOT a security audit.
- bagels 2y agoI was only addressing this part: "and still have a job". Clearly well audited code is likely safer. I just don't think that screwing that up will definitely lead to most being fired.
- scott_w 2y agoYou can’t separate “auditing can reduce chance of breaches” from “using unaudited security critical software when certified alternatives exist can be gross negligence.”