network profile
| bio | website | florentguilleux.fr |
|---|---|---|
| location | Lima, Peru | |
| age | ||
| visits | member for | 9 months |
| seen | Mar 31 at 5:07 | |
| stats | profile views | 2 |
Web developer at Pingpanel.
|
Dec 6 |
awarded | Supporter |
|
Sep 26 |
awarded | Scholar |
|
Sep 26 |
accepted | How to mitigate the risk of a continuous integration service security breach? |
|
Sep 14 |
revised |
How to mitigate the risk of a continuous integration service security breach? clarify the goal of the architecture |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? Thanks for your detailed answer bethlakshmi, I have edited my question to clarify that the main goal of the new architecture is too move the risk from the CI SaaS to a server of ours. |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? When pinging the deploy server only an existing commit of the production branch can mentioned, so hopefully an attacker should not be able to force the deploy server to deploy any code he wants. |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? The main difference between our deploy server and the CI service is that we control the deploy server while the CI service is as SaaS over which we have no control. The Heroku credentials are indeed critical and we prefer to have them hosted in a server of ours rather than on a SaaS. |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? We do, our CI setup is a way to make sure the test suite is ran before the code is pushed to production even when we forget to do it manually. |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? We are using a CI SaaS, the solution I explain in the question is made to not have the CI machine able to push code. Thanks for the race condition, had not thought about that, to prevent it will have the CI Saas ping the deploy server by specifying the exact commit(s) to deploy. |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? Having one of our developer machine getting breached is always a risk, we want to mitigate the additional risk of having a breach on a service (the CI service) over which we have no control. |
|
Sep 14 |
awarded | Editor |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? Yes we want :) That happens when one of us merges code in the production branch and push it to our central git repository. From this point we want the deploy to be automated. I've edited my question to clarify this point. |
|
Sep 14 |
revised |
How to mitigate the risk of a continuous integration service security breach? added 36 characters in body |
|
Sep 13 |
awarded | Student |
|
Sep 13 |
asked | How to mitigate the risk of a continuous integration service security breach? |
