Hacker News Reader

Comment by smadge | Hacker News Reader

SSH tunnel from localhost to prod on database port?

A likely culprit. Having worked on a bunch of early-stage products where best practices are a distant future dream, I’ve developed a few “seatbelt” habits I use to avoid these kinds of things. One of them is to always use a random high-number local port if I’m tunneling to a production service.

Another is to change my terminal theme to a red background before connecting to anything in production...never want to click the ‘psql ...’ tab, run “truncate table app_user cascade” and realize afterwards it was a lingering connection to production...

what's a situation where you'd be tunneling to a production service?

I think the most common reason I’ve had in the past was to connect to the RabbitMQ web admin while dealing with some emergent issue with task throughput, a common problem area with hacked together web apps that start to get real traffic. It’s also handy to be able to use a more advanced SQL client that’s not installed on the server (pgcli, emacs, etc) when digging around for something that’s causing errors in production.

That's my guess too. Naughty naughty. That means his production creds are the same as his development creds!

Yeah that's my guess, and likewise biggest concern - if the credentials are the same in dev and prod, it increases risk surface.

vscode remote extension perhaps

Reply on news.ycombinator.com