Unless you audit the entire codebase prior to a manual build, from a machine you know hasnt been compromised with a key you know hasnt leaked, how is a manual build different to CI/CD securitywise?
This is called two factor auth. SMS is not considered a secure method of transport (mostly due to porting). It only solves opportunistic password compromise via password dumps.
I wasn't aware that people hated it. I very rarely struggle through it (learning curve related, probably) but the objective behavior is something I wish Linux tools would move towards.
> Could you elaborate what you're talking about? Stealing passwords/sensitive info from Chrome temporary files?
Yes. Your browser stores passwords in a reversible format locally. If it's done well it may require root/ring0 privileges to abuse, but I'm unclear on how well local secret stores actually work for application-level secrets. However, if chrome temporary data becomes 100% secure I'll just steal all your documents, ssh keys and other application metadata - thus code exec is game over.
> How can one mitigate this threat?
Don't give me code exec on your box (eg don't run malware).
On a more actionable level, sandboxing every application should mitigate lots of malicious behaviors - iOS and (I've heard) chromebooks do this well, I think MacOS has some degree of sandboxing too. That being said, I don't think it'd be a practical solution for a 'power user' such as a web developer etc given the permissions power tools require are the same ones that are damaging in the hands of an attacker.
If I have code exec on your everyday system, it's game over. There are very few viable defenses without a complete architecture overhaul which would probably remove too much usable functionality to be a viable option anyway. It's just game over.
I worked with Powerbuilder for a year around 2012 as a junior. I have pretty fond memories of a completely broken workflow UI/UX. The project I was working on was an in-development replacement for a COTS COBOL application for use within a nieche market. I was just happy to land my first development job, but there were some alarm bells going off given the application hadn't had an initial release, some 10 years after development officially began.
The IDE view would allow you to select a function to view / modify via a dropdown list - it wouldn't jump to the section in code but be roughly similar to the usefulness of a one-function-per-file methodology might seem in Visual Studio, but without the Ctrl+Tab.
That in itself wouldn't have been completely horrible if you could actually navigate while the previous buffer had invalid code, or just had an intellisense equivalent that actually worked. Alas, if you couldn't remember some function or global variable name you'd need to comment out enough code to get the file into a buildable state in order for you to use your mouse to select the appropriate item from the function dropdown list in order to view the relevant section of code elsewhere within the same class file.
There was also inconsistent build behavior, I gather most compiled languages contain reference errors or similar when performing incremental builds but this fucker would actually fail mid build for no apparent reason - load it back up and rebuild the same stuff and it'd all work fine. It wasn't my computer, all devs had similar issues across multiple operating systems and minor revisions.
The application itself also had a crazy inheritance (think WYSIWYG objects with 8+ ancestors) and event hierarchy (pre-event, event, post-event. pre-save, save, post-save) which I think was sortof an immature OO and GUI ideals, implemented poorly. In powerbuilder terms this meant that not only did I have 400 events in my dropdown list of stuff that I can't access unless I create massive code blocks, but there was a second dropdown containing an equally crazy inheritance hierarchy with 400 functions at each level.
Oh, also don't forget that functions do not implicitly call their ancestors, but events do (or was it the other way around, I've tried my best to block this out of memory).
Needless to say, I bailed for greener pastures, I've since lost contact with everybody there but occasionally I check their website - they added some screenshots of the new application sometime in 2014 but I still can't find any indication it's actually sold to clients. I'm sure there are people out there that say Powerbuilder wasn't that bad, but personally I'd rather code in VB6.