Hacker News Reader

Comment by hinkley | Hacker News Reader

Nearly this exact scenario has been bugging me for a couple months. I started thinking about it due to deployment issues.

Why don't we have a proverbial two key system for certain activities like deploying to production or deleting user accounts, or backups?

We make do with things like pull requests, but everywhere we've ever had retros, I've run into situations where someone did something very stupid, somebody else rubber stamped it, and now we have a mess. Approvals on an action do not approximate the ritual sobriety that is embodied in two independent humans deciding to turn a key.

There are some people for whom these two actions can be considered equivalent, but we tend to bag on them for their meticulousness.

I think I'm wanting a tool where I type "deploy 1.0.12345 to production" and it sits there waiting until someone else types "deploy 1.0.12354 to production", and then it stops us because one of us transposed some digits.

View on HN

It's not necessarily for deploys (though you certainly could make a workflow that uses it to do so!) but I developed a dual-control plugin for sudo while at Square. We use it extensively.

https://github.com/square/sudo_pair

In action: https://raw.githubusercontent.com/square/sudo_pair/master/de...

Doesn’t that encourage using sudo in interactive mode rather than elevating for just the required commands?

I suppose you're right, but the reason that's generally advised against is so people don't run stupid stuff without thinking while root. I'd guess you're less likely to do that if a peer is watching.

And to stouset: that's a seriously cool project!

> Doesn’t that encourage using sudo in interactive mode rather than elevating for just the required commands?

It might, but policy could specify not allowing interactive mode for situations that dictate a two-man rule. Violation of said policy would necessitate a review and possible HR-related action depending on how serious the company wants to treat things.

https://blog.cloudflare.com/red-october-cloudflares-open-sou...

Someone did release a Pam module? That required confirmation before someone sudo-ed. I thought it was Stripe but I can't find it right now.

Hey, that was me! See the sister comment.

It's actually a plugin for sudo (surprisingly yes, sudo has plugin capabilities[1]) and not PAM. I had originally developed it as a PAM module, but the sudo plugin API allows for the neat trick where the TTY is mirrored.

[1] https://linux.die.net/man/8/sudo_plugin

We didn’t “release” it, but I worked on a dual-control PAM module: https://github.com/cjdev/dual-control

we have some of these systems at AWS where you need two people to approve a commit, or a type of change operation. Basically, introduce friction at various points in the name of safety.

Yeah I specifically called this out as a stopgap not a solution. For reasons of ergonomics and suggestibility (see also the primacy effect) you are more likely to make a bad judgement call when prompted into it than if you have to reason it out for yourself.

Reply on news.ycombinator.com