Mobile/Projects/APK Factory/Meeting 2013 12 19

Dec 19th Security Review

HSM or a seperate machine - minimize chances of someone getting the keys Compramise the generator asking for the signinger I/O - libraries, openssl - do pem and then convert to jwt openssl files Trunion does Extend or 2nd Trunion Put it in a queue - nothing listening in the system, open bug on adding a queue Andy Rabbit + celery [ ] Hawk between the controller and generator [ ] James - apk minutia , mark finkel or brad lassey [ ] Andy + Kumar - signer deamon