I have a major question about self hosted software like GitLab.
As many of you know, I am a huge proponent of open source and the collaboration economy.
I have put my money where my mouth is by reinvesting over half a million dollars from our startup company’s revenues into building the open source Qbix Platform, in the hopes of leading a revolution in all SAAS software, including the stuff where you need profiles, permissions, collaboration, notifications, realtime and social features on top of whatever you’re doing (git, editing a document, planning a trip).
https://m.youtube.com/watch?v=pZ1O_gmPneI
Having built v1.0 recently, we began making backwards compatible changes to eventually turn the Federated model (communities = landlords) into a permissionless, end to end encrypted and secure model for everyone. It may take us another year:
https://qbix.com/blog
We are even making our own browser because the current browsers don’t have all the features we need to pioneer the whole vision:
https://projects.invisionapp.com/m/share/TKHYMVSJNW2
BUT here is the question I have. What is the best way to UPDATE the software on the back end?
We want this thing to be secure. Discourse, Wordpress et al tell you about updates. That’s fine but how do you actually install them? By entering a password into a web interface you can get the web server user to replace all the core files of the installation? Isn’t that a vector for serious attacks?
All the attacker has to do is somehow get your password or password hash, and it’s game over. They can send the right request to do arbitrary code execution.
On the other hand, if a developer signs the new payload, this may mitigate things. It is what app stores do.
Still, how do back ends get upgraded in self hosted open source software? In SAAS you just don’t worry about it. This is one area where we could use some professional consulting :)
As many of you know, I am a huge proponent of open source and the collaboration economy.
I have put my money where my mouth is by reinvesting over half a million dollars from our startup company’s revenues into building the open source Qbix Platform, in the hopes of leading a revolution in all SAAS software, including the stuff where you need profiles, permissions, collaboration, notifications, realtime and social features on top of whatever you’re doing (git, editing a document, planning a trip).
https://m.youtube.com/watch?v=pZ1O_gmPneI
Having built v1.0 recently, we began making backwards compatible changes to eventually turn the Federated model (communities = landlords) into a permissionless, end to end encrypted and secure model for everyone. It may take us another year:
https://qbix.com/blog
We are even making our own browser because the current browsers don’t have all the features we need to pioneer the whole vision:
https://projects.invisionapp.com/m/share/TKHYMVSJNW2
BUT here is the question I have. What is the best way to UPDATE the software on the back end?
We want this thing to be secure. Discourse, Wordpress et al tell you about updates. That’s fine but how do you actually install them? By entering a password into a web interface you can get the web server user to replace all the core files of the installation? Isn’t that a vector for serious attacks?
All the attacker has to do is somehow get your password or password hash, and it’s game over. They can send the right request to do arbitrary code execution.
On the other hand, if a developer signs the new payload, this may mitigate things. It is what app stores do.
Still, how do back ends get upgraded in self hosted open source software? In SAAS you just don’t worry about it. This is one area where we could use some professional consulting :)