Hacker News new | ask | show | jobs
by pa7ch 1889 days ago
CI/CD is RCE as as service. Not opening CI/CD to the public by default seems like a security necessity.
2 comments
Longwelwind 1889 days ago
I'm building a project where my service would plug with the (unstrusted) JS code of users.

I first thought it would be easy to sandbox and have something decent running, but after making some research on sandboxing, I realize how hard it is, and the many ways bad actors can exploit a service running untrusted code.

Kudos to GitHub and GitLab for taking the challenge of providing a RCE service with a free plan.

link
PurpleFoxy 1889 days ago
Hacker news is spam as a service, not letting the public post is a necessity.

Or we could acknowledge there is a space between complete unmanaged access and no access.

link
rdsubhas 1889 days ago
Poor analogy. CI is about automating what a developer does remotely, so yes CI IS automated code execution in a remote environment, as a service. But Hacker news is "spam as a service" – huh?? They don't even compare.

Secondly, parent comment said public by default is bad. Parent didn't say "all public was bad". So there is no necessity to make it into a disagreement.

link