Security experts Ben Burkert and Chris Stolt discuss challenges in setting up secure local development environments, emphasizing the importance of encryption, HTTPS, and efficient certificate management tools. They highlight the significance of a developer-centric approach in certificate integration, explore complexities in managing certificates, introduce LCL Host for trust store automation, and praise Go's cryptography libraries for secure TLS traffic handling.
Creating a secure local environment with TLS everywhere is essential for achieving dev/prod parity and improving software quality.
Anchor offers solutions for both back-end encryption and internal TLS setups, addressing challenges with public certificates and internal CAs.
Deep dives
Developing a Secure Local Environment for Software Development
Ensuring a secure local environment for software development is crucial for achieving development and production parity. By mimicking the production environment locally, developers can catch bugs and issues early, leading to better software quality. However, encrypting local development environments and ensuring HTTPS can be challenging, with developers often resorting to bypassing TLS due to complexities. Creating a secure local environment with TLS everywhere, especially for tasks like gRPC streaming, is essential for achieving dev/prod parity and improving software quality.
Anchor offers solutions for both back-end encryption and internal TLS setups, addressing challenges with public certificates and internal CAs. A key feature is the creation of a custom CA for each user's development environment, limiting certificate issuance to specific subdomains. Anchor's CLI tool, open source on GitHub, streamlines the process by provisioning certificates, configuring trust stores, and enabling easy domain setup for secure local development. Additionally, Anchor provides open-source Acme clients for various languages to enhance the Acme support beyond Go and improve TLS automation.
Open Source Contribution: Revolutionizing TLS Libraries
The popularity of Go's cryptographic libraries plays a significant role in the language's success. Go's decision to build its TLS stack and cryptographic packages instead of relying on problematic solutions like open SSL has been pivotal. By offering secure and manageable interfaces for TLS operations, Go enhances static builds and simplifies network interactions without external dependencies. The Go security team and contributors have created a secure ecosystem, making cryptography libraries a vital but often underrated aspect of Go's success.
Enhancing Developer Experience Through Support Engagement
Engaging developers in customer support activities is pivotal for understanding user pain points and improving products. While developers may hesitate to enter support-related tasks, firsthand customer interactions provide valuable insights into user experiences and product usage. Collaborating with support teams helps developers gain a deeper understanding of user needs and challenges, leading to enhanced product quality and better support experiences.
In this episode, Ben Burkert & Chris Stolt join Johhny to explore the ups & downs of trying to get secure local development environments set up, why it’s hard & what you can do about it.
Changelog++ members save 6 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
FireHydrant – The alerting and on-call tool designed for humans, not systems. Signals puts teams at the center, giving you ultimate control over rules, policies, and schedules. No need to configure your services or do wonky work-arounds. Signals filters out the noise, alerting you only on what matters. Manage coverage requests and on-call notifications effortlessly within Slack. But here’s the game-changer…Signals natively integrates with FireHydrant’s full incident management suite, so as soon as you’re alerted you can seamlessly kickoff and manage your entire incident inside a single platform. Learn more or switch today at firehydrant.com/signals
Notion – Notion is a place where any team can write, plan, organize, and rediscover the joy of play. It’s a workspace designed not just for making progress, but getting inspired. Notion is for everyone — whether you’re a Fortune 500 company or freelance designer, starting a new startup or a student juggling classes and clubs.