sorted by: new top controversial old
[-] [email protected] 47 points 1 week ago


[-] [email protected] 2 points 1 week ago

servers rarely see updates. Maybe it happens in larger firms, but not in smaller shops.


[-] [email protected] 2 points 1 week ago

adding PPAs or RPM repos, or installing things from source, I'd say that number is a lot higher than 0.

Nothing wrong with that. Unlike docker that's cryptographically protected toolchain/buildchain/depchain. Thus, a PPA owner is much less likely to get compromised.

Installing things from source in a secure environment is about as safe as you can get, when obtaining the source securely.

Docker contains that nonsense in a way that's easy to update.

Really? Ist there already a builtin way to update all installed docker containers?

What's uneasy about apt full-upgrade?

Package managers don't provide a sandbox.

I didn't say that.

average user who doesn't run updates consistently, may add sketchy dependencies, and doesn't audit things would be better off with Docker.

That's false.

but they're less likely to cause widespread issues since each is in its own sandbox.

Also false. Sandbox evasion is very easy and the next local PE kernel vulnerability only weeks away. Also VM evasion is a thing.

Basically one compromised container giving local execution is enough to pwn your complete host.

[-] [email protected] 2 points 1 week ago

in the same way that installing a malware-laden executable isn't an OS problem

except no one is doing that. Every major distro hast mechanisms for software supply chain security and reproducible builds.

Do your due diligence, especially if you're not a developer and thus looking at the Dockerfiles is impractical.

You're on to something here. If you automate that process, you end up with something we call a package manager.

it's likely blog posts and users that are at fault.

Exactly. And sincer reviewing Dockerfiles is impractical, there's no way docker prevents you from shooting your own foot. Distros learned that long ago: Insecure default configs or injected dependencies are a thing of the past there. With docker, those get reintroduced.

[-] [email protected] 2 points 1 week ago* (last edited 1 week ago)

What you are saying is not new but you don't seem to grasp the difference in risk when you run someone else's configured environment on your system vs. manually setting them up yourself. You save a lot of time by using docker images but it comes with a price.

There's no docker vulnerability

No need to. Like sudo doesn't need a vulnerability when you let contributors of some repository use it on your box.

Things like snyk exist for a reason but it's not mitigation, just monitoring.

You should stop telling people that using docker is no security problem because that's wrong, as it adds attack surface to even the most secure projects. Sure, it saves time but things like OPs news will keep popping up in the future like it did in the past. It can't be fixed other than just not using it in production. At least build your own containers.

Don't forget various past issues:

[-] [email protected] 3 points 2 weeks ago* (last edited 2 weeks ago)

This entirely misses the point of Docker.

It's just pointing out the risk of letting someone you don't know with no legal obligations setup your complete environment.

How likely

Probably as likely as someone cracking your really secure ssh password. Still, any sane expert will recommend disabling password auth.

I only pull containers based on some official project.

How do you know they weren't compromised?

but I don't see anything here about Docker itself being a problem

The problem is that rootless docker is a pain and no one does it. Privileged software sideloading other software is a huge risk.

That risk now became an incident. Even if you're not affected, the risk still remains.

[-] [email protected] 2 points 3 weeks ago

exactly. Forking for any reason is the essence of FOSS.

Scenarios like OPs were taken care of right from the start. That's just the legal side, tho. But someone still needs to do the actual work which is why it sometimes fails.

[-] [email protected] 3 points 3 weeks ago


[-] [email protected] 10 points 3 weeks ago* (last edited 3 weeks ago)

Public funds.

There actually are lots of initiatives (e.g. ) but it's still young and there are multiple problems between available public money and contributors actually earning a salary.

Money is not the problem.

[-] [email protected] 25 points 3 weeks ago

Exemplarisch für den verkommenen akademischen Gedanken im Schulsystem: Nämlich sich mit einem Spezialgebiet beschäftigen, es vertiefen, Thesen aufzustellen, diese diskutieren/belegen/wiederlegen/verteidigen, gewonnene Erkenntnisse wissenschaftlich konform verschriftlichen usw.

Genau DAS sollte die (weiterführende) Schule eigentlich spielerisch vermitteln und fördern.

Egal ob da T-Shirts gefärbt, Stinkbomben gebastelt, Roboter konstruiert oder über irgendein Thema diskutiert wird - solange es pädagogisch wertvoll ist, erwarte ich, dass das Schulsystem jegliches freiwillige Engagement von Schülern bestmöglich unterstützt.

[-] [email protected] 24 points 3 weeks ago

either earn a good living being a code monkey, or find a job in a small company that has passion

crazy idea: let's publicly fund FOSS projects so devs working on stuff they like with a passion can actually make a good living and enable sustainable non-profits to hire expertise, marketing and all the stuff a company needs

the result would be actually good software and happy devs

[-] [email protected] 1 points 1 month ago

In deutschen Wohnungen produzieren sie normalerweise rasch tropische Schwüle.

Das stimmt, aber da es immer ein Feuchtigkeitsgefälle nach aussen gibt, funktioniert das mit Lüften ganz gut.

Mit "knochentrockener" Luft funktioniert es natürlich am besten aber Deutschland ist nicht der Amazonas und hier macht es zumindest für mich an heissen Tagen viel Unterschied und kost praktisch nix.

Wenn die Sommer noch heisser werden, kommt Klimaanlage mit PV her.

view more: next ›


joined 11 months ago