3 ms·
Prod tends to have less privileges than CI/CD. CI/CD tends to be full admin, so it's far more sensitive. Prod tends to have tooling for detecting breaches, bett
by insanitybit 2mo ago
Prod tends to have less privileges than CI/CD. CI/CD tends to be full admin, so it's far more sensitive. Prod tends to have tooling for detecting breaches, better logging, etc. People tend to use containers, which act as a sandbox.
Prod also won't be wormable the way that CI/CD is. With CI/CD I can own another dev, use their creds to push another malicious build script, etc. "Attacker is in my prod env" isn't wormable.
Yes, capabilities in prod would be hugely beneficial but removing CI/CD is massive as a win.
- JustSkyfall 2mo agoWouldn't the dropper get executed once tests are run within CI though?
- jitl 2mo agoyeah, or when a dev starts the local development server (unless that server is containerized).
- insanitybit 2mo agoDev laptops tend to have better monitoring than CI/CD so I still think this is a better option. You can also have devs use VMs or separate dev environments like an ec2 instance. To be clear, just solving the CI/CD portion is insufficient, but it is a massive win.
- insanitybit 2mo agoYes, you should separate "tests execute" into their own unprivileged workflows that don't have "deploy" secrets.
- rcxdude 2mo agoYou can also do the same for the build workflow, no?
- insanitybit 2mo agoYep, I'd recommend it.