31–40 of 269 posts
I wonder if that will encourage them to finally resolve this issue: https://github.com/docker/docker.github.io/issues/6910
(Side note: this obviously wouldn't have prevented the current attack)
Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.
I was originally going to argue with it being "just a matter of time" -- there is such a thing as good security practices. It's certainly not "just a matter of time" before Microsoft or Google see such compromises. I'm pretty confident that these companies have their sh*t in order. But no, not Docker. You're totally right; with as important as their registry is to well funded attackers, and as startup-y and "agile" a…
[0] https://twitter.com/WHHackersBR/status/1118393568656334850
I wonder if that will encourage them to finally resolve this issue: https://github.com/docker/docker.github.io/issues/6910
Or fix this 4 year old issue where you cant use 2FA for accounts https://github.com/docker/hub-feedback/issues/358 (Side note: this obviously wouldn't have prevented the current attack)
Earlier quoted context omitted.
> Well, this is pretty disappointing. Docker doesn’t let you install it without an account, so I registered and used it for maybe a day in all. And poof, there goes my account data. Eh? Doesn’t let you use what without an account? Anyone can pull images anonymously. An account is only for publishing.
Installing Docker for Mac/Windows has required users to login for awhile now.
Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.
There already have been questionable images hosted there ... just by users uploading compromised images. No hacking needed.
Earlier quoted context omitted.
I was originally going to argue with it being "just a matter of time" -- there is such a thing as good security practices. It's certainly not "just a matter of time" before Microsoft or Google see such compromises. I'm pretty confident that these companies have their sh*t in order. But no, not Docker. You're totally right; with as important as their registry is to well funded attackers, and as startup-y and "agile" a…
Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0]…
Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.
I was originally going to argue with it being "just a matter of time" -- there is such a thing as good security practices. It's certainly not "just a matter of time" before Microsoft or Google see such compromises. I'm pretty confident that these companies have their sh*t in order. But no, not Docker. You're totally right; with as important as their registry is to well funded attackers, and as startup-y and "agile" a…
It wasn't authentication credentials, but still.