Hi all,
Here is list of things we should discuss and do:
*** every one who write code to conductor should read the security guidelines
for rails[1] most relevant are chapters after 4.
*** it looks like we are doing thing in the right way in the rails code part
*** storing credentials/certificates as plain text in the db
*** but we need to solve this problems:
--- Encrypt the communication between Conductor and the database
(probably SSL)
--- Protect the authentication credentials to the database
(for what I know this is done by setting right permissions to the
configuration file)
links:
[1]
http://guides.rubyonrails.org/security.html
--
Tomáš Hrčka