Viewing profile — bigmac

Folks need to worry about being able to protect more than just passwords. Engineers should be doing a good job of protecting SSNs, phone numbers, home addresses, etc. Crypto-anchor…

This isn't only about HSMs or dedicated services. To anyone reading this thread: the key thing to understand here is: How do crypto-anchors help against attacks that allows `select…

FWIW I was concerned folks would get caught up on the password storage use case since so many are familiar with that problem. The crux of the idea of crypto-anchoring is to segment…

We discuss exactly this architecture in the talk we gave back in 2014. See here for the part where we discuss it: https://youtu.be/lrGbK6fE7bI?t=16m31s Basically we 100% agree with…

Folks shouldn't necessarily be scared off by the use of HSMs in this model -- HSMs are an add-on that adds an additional layer of security. That said, there are still significant w…

One of the great things that helps when building a crypto-anchor enabled infrastructure is to have Mutual TLS between all applications/containers. This allows you to authn/authz an…

Importantly updates are not handled by LinuxKit itself[1] but the concept is that that a higher level system or packager might take care of via CloudFormation and an out-of-band re…

For those interested in security in particular, we've outlined the opinions and design decisions here: https://github.com/linuxkit/linuxkit/blob/master/docs/securi... In short: Ker…

At a design level, push removes an entire class of vulnerabilities, full stop. Pull requires good ACL'ing and properly implemented controls for the lifetime of the orchestration sy…

There's no way to schedule anything from a worker node -- Swarm follows a push model for all scheduling decisions; worker nodes never pull anything. This is the best ACL model poss…

We're working with Red Hat now. Folks can expect more technical details when everyone is on the same page. That said, the solution is the same as with every other piece of software…

This post is incorrect. SELinux does not fully mitigate this issue. We recommend users update to 1.12.6. I expect Red Hat to issue a retraction shortly. We notified them last night…

Do not use Docker distributed by Red Hat, full stop. It has been irresponsibly patched to be insecure. They disable important seccomp filters. Instead, install using instructions h…

In terms of signing and verification, doing trusted pulls of the official ubuntu image (or any other official image) is quite easy: export DOCKER_CONTENT_TRUST=1 docker pull ubuntu…

You're right -- it needs to be enabled manually using `--opt encrypted`. 1.13 is shooting for this to be the default.

We've done a ton of work on image signing. Look in to Docker Content Trust ( https://docs.docker.com/engine/security/trust/content_trust/ ) and Notary ( https://github.com/docker/n…

Great points, we're working on a bunch of this stuff. Docker 1.12 in swarm mode, for example, does automatic key rotation and issuance of the TLS certs assigned to every node in th…

We are on the case right now. The solution is going to be really, really good. We had to get cryptographic node identity rolled out first and we're designing secrets management on …

The important metric with patching vulnerabilities is time-to-patch. Docker based environments are able to significantly reduce time-to-patch precisely because the libs are bundled…

This couldn't be further from the truth. Docker containers run with default seccomp profiles, namespacing (filesystem, PIDs, mounts, etc), LSM policies (AppArmor, SELinux), and cap…

Responding to your edit: Notary, the underlying project that implements Docker's Content Trust feature, is an implementation of The Update Framework (TUF). Generally, you want a so…

The several daemons serve two purposes: 1. We have to host the signatures somewhere, so we host them in a store we call the notary server. 2. Notary has a concept of timestamping, …