Hacker News Reader

Comment by cyberferret | Hacker News Reader

Excuse me while I pick myself up off the floor when I read "leaks environment variables"... What?? That is incredibly scary for use, as we just went through an audit process of our code on about 6 different web apps to ensure that all secrets were placed in environment variables on our Elastic Beanstalk configs and not in the main codebase... If this now results in LESS security (all our code is in private Git repositories) than before, then we have essentially taken a step backwards!

View on HN

Github private repos have been made public by mistake before. Got repos are cloned on dev laptops, do you enforce laptop encryption?

The right thing to do is using some form of a vault.

We use BitBucket here, rather than Github - similar risks, I know, but we have predetermined repositories which are all set as private. 3 dev machines which are kept on premises at all times.

Still not optimal as far as security goes, but it seems that he have roughly the same exposure if AWS leaks our keys and passwords to other third party trackers...

Use kms and dynamodb with key enveloping, or this tool: https://github.com/fugue/credstash

Don't initialize into env vars and don't store in repos, even private ones.

Thanks - sounds like a good solution. I will look into this in detail over the weekend.

Be careful when modifying user access to a private BitBucket repository. Their autosuggest for the username input field will show all bitbucket users. Makes it incredibly easy to accidentally grant somebody outside of your organization access to a repository.

I can attest to that. I have the username "tim" on bitbucket and get added to private repos all the time by mistake.

On top of that, there's no audit history of who has had access to a repository. Absolutely ridiculous.

This is really the best suggestion. I've been using Hashicorp's Vault for storing sensitive configuration information and can't recommend it enough. The rest of Hashicorp's stack of software for Docker is also extremely nice.

The best audit proof solution to this is using an encrypted database where you can securely push down secrets that you share only with certain users on particular nodes. This is what we used earlier with a bigger company to pass all audits. The ability of reading secrets are tied to a unix user and a fleet (identified by IP ranges for example). The secrets are encrypted and the nodes have the key do decrypt it. Keys are distributed securely at provisioning time. I am not aware any opensource platform that would do this to you out of the box though.

Reply on news.ycombinator.com