That specific approach wouldn't really work in this case as you'd have to restart the process with the shim in place but you wouldn't be able to because you'd be missing one of Rails required initializer, which contains the secret.
Maybe the admin would be able to install the shim globally, but if you don't really trust your admin you could create some kind of checksum of your system of and refuse to deploy if it has changed. Softwares like Bacula are able to do things like that. Then you could diff with your known state to see what has changed so that you'd know whether the changes are safe or not. Bacula has such a feature for instance. But since this requires a lot of work, it would be much simpler to not keep employees you don't trust. There's much worse things system admins could do if they want to. In any case I don't find it trivial to steal the secret from a running process. Em 28/03/2014 23:17, "Michael Koziarski" <mich...@koziarski.com> escreveu: > > > > On Sat, Mar 29, 2014 at 1:52 PM, Rodrigo Rosenfeld Rosas < > rr.ro...@gmail.com> wrote: > >> Forget about using environment variables. Those are the easiest to >> checkout if you're root in a Linux server for instance. I could easily read >> it in a quick test. >> >> I'm curious though to see how easy would it be to use GDB to attach to a >> running application after the deploy script has removed the file with the >> key after the application has booted... >> > > Trivial. If it's in memory, you can rip it out. > > > http://timetobleed.com/ripping-oauth-tokens-or-other-secrets-out-of-tweetdeck-twitter-app-and-other-apps/ > http://seriot.ch/abusing_twitter_api.php#32 > > etc. > > > > -- > Cheers > > Koz > > -- > You received this message because you are subscribed to the Google Groups > "Ruby on Rails: Core" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to rubyonrails-core+unsubscr...@googlegroups.com. > To post to this group, send email to rubyonrails-core@googlegroups.com. > Visit this group at http://groups.google.com/group/rubyonrails-core. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To unsubscribe from this group and stop receiving emails from it, send an email to rubyonrails-core+unsubscr...@googlegroups.com. To post to this group, send email to rubyonrails-core@googlegroups.com. Visit this group at http://groups.google.com/group/rubyonrails-core. For more options, visit https://groups.google.com/d/optout.
