brain-dump's People
Contributors
Watchers
brain-dump's Issues
Store Credentials
重點從來不是怎樣防止進信任的system admin或寫了後面的developer作案，而是降低意外疏失。
只有通過env (或不是寫死在code裡)，用vault或kms等software，才能確保:
- 密碼可以快速、定期輪換，而不是長年無論admin/developer換了多少個人都用同一個密碼
- 定期輪換的優點有: DBA/admin保存在外的密碼洩露了也沒問題 (始終是會需要有人有DB access)
- 可以綁定不同的機器/IP/TPM/Yubikey/gnupg等，只有那些機器才能拿到那台機器才能用的密碼。同一組密碼不能在其他機器用，讓壞人不能從一台的密碼然後在另一台發動攻擊 (很多時候攻擊要利用不用的漏洞，例如在web那邊匯出了db password、同時發現內部網絡有入口…但如果那組密碼是那台web專用的話即使拿到了也沒用)
不是env/config file/k8s secrets就特別安全讓system admin免不見，而是你不用這些的時候你要怎樣自動化密碼輪換(rotation)？根本沒可能。
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.