71–80 of 92 posts
No C#/Nuget support? Really?
That is strange, I wonder if that's coming later but I didn't see anything to that effect. I'd also have liked to see docker image support (despite ecr) and raw binaries too.
Earlier quoted context omitted.
Static feeds are much slower than one that use a real server.
Any reason why? Could we not make it faster?
Earlier quoted context omitted.
The problem isn't encryption, let's assume everyone has full disk encryption turned on, so someone who steals your laptop can't access your data. The problem is that your home directory is accessible to a ton of apps on your computer, and you have no idea what each of them is doing with that access. You also have no idea if any of them can be / are being exploited. The most recent case being Zoom – if that server the…
In that case, the rogue app would have access to your temporary credentials anyway...
Earlier quoted context omitted.
The problem isn't encryption, let's assume everyone has full disk encryption turned on, so someone who steals your laptop can't access your data. The problem is that your home directory is accessible to a ton of apps on your computer, and you have no idea what each of them is doing with that access. You also have no idea if any of them can be / are being exploited. The most recent case being Zoom – if that server the…
If you have an app on your computer that is controlled remotely you have _massive_ issues. Creds are stored for SSH, browser, probably heaps of other things too. If this is a serious security concern within your threat model you should be auditing every single package or isolating (docker, vms, Bare metal if you’re super tin foiled), anything short of that is fake security.
And ideally these credentials should have similar controls applied around them as well (only temporary, using passwords to unlock the SSH keys, etc). If you don't have that, that's your choice, but just because some of your credentials lack security controls is not a reason for other credentials to lack security controls, too.
> you should be auditing every single package or isolating (docker, vms, Bare metal if you’re super tin foiled), anything short of that is fake security.
Which is exactly the reason that many orgs do specifically audit every package and disallow unapproved software. But again, even if some of your desktop apps are allowed unaudited, that is not reason to lessen your security elsewhere.
No C#/Nuget support? Really?
Whenever I see a product announcement like this missing something I need to use it, I immediately ping our Technical Account Manager to get the vote up for a particular enhancement.
Earlier quoted context omitted.
I think mainly the ease of having security dealt with around who can access etc really. Ofc you can just upload files and serve them over http, but I'd like something that's as easy to setup and use as nexus for these files - and something that forces a structure for how they are organised. Stops arguments and people doing whatever they want.
>> I think mainly the ease of having security dealt with around who can access etc really. Ofc you can just upload files and serve them over http, This is where S3 really shines. You can give developers access through group membership while servers using instance profiles. We have implemented a fine grained access control for the S3 repos that works really well. Of course you access the content via HTTPS.
IAM is on the AWS repo aswell isn't it? I guess it wouldn't be so bad then.
Earlier quoted context omitted.
Your source code may reference a shared library at a specific version from a trusted source to build. This trusted source is CodeArtifact. The short lived passwords is a non issue and a good thing. Your dependency resolver should handle fetching the new password and most orgs I’ve worked at had scripts dealing with short lived passwords/iam.
> Your dependency resolver should handle fetching the new password According to AWS's documentation, none of the supported dependency resolvers will fetch the new password[1][2][3]. If they were capable of automatically fetching the new password without human intervention, it would mean they have credentials for generating credentials. If this isn't on an EC2 instance (where an IAM role can be used), that means there…
In terms of local development experience, most mature organizations will have these "long lived" credentials still require an MFA at a minimum of once per day and locked down to particular IP addresses to be allowed to get the temporary credentials.[1]
> This would be the case if you are using a hosted CI service that doesn't run on your own EC2 instances.
Typically you'd want to see third-party platforms leveraging IAM cross-account roles these days to fix the problem of them having static credentials. Granted, many of them are still using AWS access key and secret.
This is still not a "solved" area though, and a point of concern I wish would get more aggressively addressed by AWS.
[1] https://github.com/trek10inc/awsume, https://github.com/99designs/aws-vault, and a few other tools make this much easier to deal with locally.
It’s frustrating to not see more system package management (deb, rpm) from these new services (github and gitlab for instance). Are others not packaging their code in intermediate packages before packing them into containers?
Is it just me or is this missing plain artifacts - those that are not packaged for a specific tool? I'm thinking of plain binaries and resources required for things like db build tools and automated testing tools - just files really. How do I publish a tarball up to this, for example? Also the lack of nuget is a major issue.
It’s frustrating to not see more system package management (deb, rpm) from these new services (github and gitlab for instance). Are others not packaging their code in intermediate packages before packing them into containers?
What's the purpose of intermediate packages if you're already using containers?