,
4 tweets,
2 min read
Read on Twitter
A couple great questions came out of the #NYCK8S meetup on Thursday! (Terrific meetup, btw, absolutely stellar crowd.)
First one: what about high security environments, developers can't really go plumbing around in prod willy-nilly like that, can they?!
First one: what about high security environments, developers can't really go plumbing around in prod willy-nilly like that, can they?!
Answer: hellz yes they can! Developers must be able to own their code in production. No exceptions, just many excuses. ☺️
First of all, if your needs are so high, your super secret shit should not be cropping up in operational data! See lengthy thread:
First of all, if your needs are so high, your super secret shit should not be cropping up in operational data! See lengthy thread:
There are tons of ways to abstract secure data from ordinary operational access patterns. Encryption at rest, wrappers and audit logs, yada yada.
But as @lizthegrey points out: all the regulations really require is a two-person protocol.
But as @lizthegrey points out: all the regulations really require is a two-person protocol.
Security is important. We do it a real disservice when we cargo cult bad instructions, or use it as an excuse.
Until your devs can own their code in prod, your teams, your engineers' development, your culture and *certainly* your systems -- they are all broken.
Until your devs can own their code in prod, your teams, your engineers' development, your culture and *certainly* your systems -- they are all broken.
