Hacker News Reader

Comment by benoau | Hacker News Reader

> Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.

One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb mistake, one up-arrow too many, one didn't-read-the-whole-line, and now you're doing something to production by accident!

View on HN

I also did that, for a team deploying smart contract on chain from local.

It took a couple months to get the pipeline out of their laptop.

Worth it, yes, as we found interesting things in there which explained why they were so reluctant to deploy upgrades.

> as we found interesting things in there which explained why they were so reluctant to deploy upgrades

.. backdoors which enabled the dev to deploy exploits of their own which wouldn't be visible through CI?

No, rather a particular environment with monkey patched libraries, alias for various versions of compliers, and dozens of env variables that happen to work or not work well with the desired config.

What sorts of processes related to secret storage were you able to shift off of team computers? From my perspective, if I need to get e.g. an API key from Twitter and put it into my prod environment, i have to be doing that with my computer somehow. There's still millions of different types of secrets that need meat puppets to shuffle them around.

> There's still millions of different types of secrets that need meat puppets to shuffle them around.

Sure, but those meat puppets shouldn't be developers, they should be administrators, using proper procedures.

Separation of powers seems so fundamental yet also so totally ignored these days.

TBH CI does not prevent this kind of mistakes. I've seen people triggering the wrong CI pipeline.

I guess people triggering the pipeline is already part of the problem

No matter what you do, at some point you have some human performing some action which will, after N indirection layers, result in a change in prod, unless you have the mythical fully automated agentic software factory.

Reply on news.ycombinator.com