Charity Majors @mipsytipsy CTO @honeycombio, ex-Parse, Facebook, Linden Lab; cowrote Database Reliability Engineering; loves whiskey, rainbows. I test in production and so do you. 🌈🖤 Mar. 31, 2019 1 min read

A couple great questions came out of the #NYCK8S meetup on Thursday! (Terrific meetup, btw, absolutely stellar crowd.)

First one: what about high security environments, developers can't really go plumbing around in prod willy-nilly like that, can they?!

Answer: hellz yes they can! Developers must be able to own their code in production. No exceptions, just many excuses. ☺️

First of all, if your needs are so high, your super secret shit should not be cropping up in operational data! See lengthy thread:

There are tons of ways to abstract secure data from ordinary operational access patterns. Encryption at rest, wrappers and audit logs, yada yada.

But as @lizthegrey points out: all the regulations really require is a two-person protocol.

Security is important. We do it a real disservice when we cargo cult bad instructions, or use it as an excuse.

Until your devs can own their code in prod, your teams, your engineers' development, your culture and *certainly* your systems -- they are all broken.


You can follow @mipsytipsy.



Bookmark

____
Tip: mention @threader_app on a Twitter thread with the keyword “compile” to get a link to it.

Enjoy Threader? Sign up.

Threader is an independent project created by only two developers. The site gets 500,000+ visits a month and our iOS Twitter client was featured as an App of the Day by Apple. Running this space is expensive and time consuming. If you find Threader useful, please consider supporting us to make it a sustainable project.