On 09/20/2011 12:34 PM, Mo Morsi wrote:
On 09/20/2011 12:00 PM, Tomáš Hrčka wrote:
> Hi all,
>
> Here is list of things we should discuss and do:
>
> *** every one who write code to conductor should read the security
> guidelines
> for rails[1] most relevant are chapters after 4.
>
> *** it looks like we are doing thing in the right way in the rails
> code part
> *** storing credentials/certificates as plain text in the db
> *** but we need to solve this problems:
> --- Encrypt the communication between Conductor and the database
> (probably SSL)
> --- Protect the authentication credentials to the database
> (for what I know this is done by setting right permissions
> to the
> configuration file)
>
> links:
> [1]
http://guides.rubyonrails.org/security.html
+1.
Up to this point our quality efforts has been focused on software
functional quality (which QE has been doing an amazing job at and I
really thank them for their hard work, especially with their limited
resources). Going forward we also need to be focusing on software
structural quality. See the distinction on wikipedia:
http://en.wikipedia.org/wiki/Software_quality
-Mo
Hope this doesn't come off as too controversial. I'm not criticising
anything anyone has done, I think the effort by both development and QE
has been phenominal up to this point and I would like to give my kudos
to the entire team. Just would love to see more resources devoted to
structural quality, perhaps we can bring in some new quality engineers
to help w/ this?
-Mo