3 ms·
Interesting, resig's approach doesn't work with continuous deployment, unless you want to decrypt stuff each build (which would be less secure). Ntnt's solution
by ukd1 13y ago
Interesting, resig's approach doesn't work with continuous deployment, unless you want to decrypt stuff each build (which would be less secure). Ntnt's solution sounds awesome but imho over kill - a whole extra server?
- hamburglar 13y agoPersonally, I'd happily deploy an extra server or two (redundancy) to keep from having credentials laying around unencrypted on production machines.
- ukd1 13y agoThis is dumb. If they need a secret, they request them using another key. Therefore they have access to all the secrets they would have needed anyway. What does this gain? It adds a ton of complexity and a major failure point.
- hamburglar 13y agoThe interesting part to me is leveraging the ssh agent. Yes, the secrets are all behind yet another key, but it happens to be a key that doesn't leave your local machine even when it's being used to get access to a remote secret, plus it's a key that you likely already have set up (and hopefully secured) for ssh access.