GitLab Major Security Update for CVE-2016-4340

Post by sytse » Fri, Apr 29, 2016, 2:39 PM UTC

dperfect wrote: post #15

jarfil wrote: post #14

Earlier quoted context omitted.

The "latest builds" page shows automated builds created by docker hub, but repo owners can also manually push builds created by themselves, which seems to be the case.

Ah, that makes sense - thanks. Looks like many (most?) of the most popular images on Docker Hub are as you say - manually-pushed builds. A part of me wishes that more of them were automated, just to have more visibility into what exactly goes into each image. I guess that's off-topic though.

Post by Sephr » Tue, May 03, 2016, 9:40 AM UTC

sdesol wrote: post #27

angerman wrote: post #22

It feels to me as if GitLab is pushing (major) security updates very often. Now there are two reasons I can think of this happening: - They are very open about security vulnerabilities and fix them fast. - There are some inherent defects in their software that cause these security vulnerabilities to come up so frequently. I'd like to believe it's the first. EDIT: formatting.

> Now there are two reasons I can think of this happening They are also churning at a pretty insane rate due their release schedule. I did a very basic analysis of their repos at http://gitsense.github.io/blog/motion-bubble-charts.html And this is the churn for this month in their master and 8-7-stable branch http://imgur.com/PfyFrzS I also included the https://github.com/atom/atom master branch (blue line) for compa…

Post by sytse » Thu, May 05, 2016, 8:15 AM UTC

angerman wrote: post #22

It feels to me as if GitLab is pushing (major) security updates very often. Now there are two reasons I can think of this happening: - They are very open about security vulnerabilities and fix them fast. - There are some inherent defects in their software that cause these security vulnerabilities to come up so frequently. I'd like to believe it's the first. EDIT: formatting.