51–55 of 55 posts
Earlier quoted context omitted.
Setting up a firewall like ufw could prevent accidental port mapping to 0.0.0.0. I really don’t like that this is Docker‘s default.
Last time I checked (~year ago) Docker used different iptables chain(s) than ufw or added itself before ufw rules, so ufw was useless in securing access to ports exposed by containers.
Earlier quoted context omitted.
Probably but you can still have the configuration secure as default and people would be aware of the security implications when enabling insecure features.
You're vastly overestimating the technical capabilities of the average person installing or creating software.
We are talking about an ini file. This isn't rocket science.
Earlier quoted context omitted.
You're vastly overestimating the technical capabilities of the average person installing or creating software.
I am talking about whoever is packaging PHP for the OS, there is a default php.ini that comes with PHP on CentOS is insecure by default (I can't remember off the top of my head which settings were set to something insecure). We are talking about an ini file. This isn't rocket science.
Earlier quoted context omitted.
I am talking about whoever is packaging PHP for the OS, there is a default php.ini that comes with PHP on CentOS is insecure by default (I can't remember off the top of my head which settings were set to something insecure). We are talking about an ini file. This isn't rocket science.
Right, but they need to be conscious of their end user. If they secure by default, and someone upgrades, their software stops working. Should PHP have had these defaults to begin with, yes absolutely. But now we're all stuck with a million miles of code that will break if register_globals is turned off. That's the point. Everything you've stated above there might as well be an alien language to the majority of people…
However they will now be aware that said feature is insecure and should know the consequences of enabling it.