111–120 of 269 posts
I thought, maybe I need to log out and try if the new password works. I clicked on Log Out link, the website has refreshed and I was still logged in.
Does this lessen the relevance that docker has these days?
Did Docker become any less useful for you due to this, or provides less value? Unlikely.
And the main usecase is k8s. So docker is just an implementation detail its relevancy is waning imo
Earlier quoted context omitted.
Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0]…
And do we ever find out how much that was being exploited "in the wild"?
Docker Hub being hacked was basically just a question of time. With how much of the internet blindly pulls images from it, the potential gain from hijacking just one high-profile one would be monumental.
Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...
Actually only short names go to docker hub, one can setup their own registry and use it via dns names.
Example: docker pull quay.io/letsencrypt/letsencrypt
Earlier quoted context omitted.
Yes, huge poisoning target enhanced by the fact images/tags are not immutable, you really have no idea what you are fetching straight from dockerhub, one pull of the same image/tag may be different to the next pull. Most people blindly fetch without verifying regardless with multiple images of varying quality for software packages.
How could one verify ?
If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…
Earlier quoted context omitted.
Maybe some day we'll get serious about reproducible builds, since reproducibility can serve as a layer of defense against such compromises.
Maybe I'm missing something, but reproducible builds wouldn't be that helpful here with write access to the source repo, no? Definitely wouldn't have helped prevent the compromise.
Earlier quoted context omitted.
Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...
> Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware. I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how t…
Earlier quoted context omitted.
Hacking aside, Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it. It's centralized. It doesn't have a context of "trustworthiness" yet I don't recall docker ever warning me that the image I'm downloading could have been the work of any person. Shortcuts all around -- kind of reminds me of MongoDB. Sad it's the primary player...
> Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware. I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how t…