News for hackers. Stuff that matters.

A comment on Gitlab Critical Security Release. Parent comment

Re:Gitlab Critical Security Release by jdvh on Saturday February 26, 2022 @12:55PM (#30479911)
What's the attack surface of a git linux account that doesn't have a shell and can only log on through ssh with a key from whitelisted IPs in a firewall? Compare that attack surface with that of a complicated web app like gitlab.
[ Parent | on HN ]
Re:Gitlab Critical Security Release by gmfawcett on Saturday February 26, 2022 @01:03PM (#30480010)
Sure, but you could control access to the Web app, too? E.g. allow only certain VPN accounts to access it? There are lots of ways to manage attack surfaces.
[ Parent | on HN ]