Hacker News Reader

Comment by lupire | Hacker News Reader

Virtual is part of a solution but not the key: the key is to separate your dev env from your real life/business environment -- including all your personal and professional business data and web accounts that expose your financials and private data.

If you log into your email from the virtual machine, you are at risk.

View on HN

That protects me (the software developer/maintainer) to some degree, but does nothing to protect the users of the software I am maintaining.

As long as your are creating web applications then browsers are pretty good at limiting blast radius of a single attacked website. Well, at least until attacker discovers that he can inject some fancy phishing into trusted site.

With local development environment it is a bit different, because unless you are running build/test etc. in a container/vm/sandbox, then attacker has access to all of your files, especially web browser data.

Development should be more exploratory and experimental than prod. For the past decade I've had a similar strategy: I freely install and demo new dependencies on separate dev hardware (or a VM when I'm on the road). Then I code review (incl. locked dependencies) and deploy from a trusted environment with reduced supply chain exposure.

I think that separation is the point of the VM. Do the dev work in the VM, don't give it sensitive info about yourself.

The only place I log into from the VM is Github, protected by 2FA in case any malware gets my password.

The malware will just take the session cookie. Some actions still require 2FA approval, but it’s not many, iirc.

So the malware can delete all your projects or inject malware into them, but thankfully it won't be able to log in again later?

Reply on news.ycombinator.com