Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kubernetes ingress-nginx controller vulnerability

armosec.io

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Kubernetes ingress-nginx controller vulnerability

#21

Post by jl6 »

tbrownaw wrote: post #5
jeffbee wrote: post #2

Are they for real with that curl? Normalize better security practices!

I think it's contrary to currently-recommended ops practice (clearly imperative rather than nominally declarative), but how is it bad security practice? If you don't trust the origin, it's not like saving to a temporary file first is going to help you. Unless you're suggesting that everyone should always do their own code review and then compile from source...

Saving to a file first means you can at least run it in a test environment first, then be confident you’re running the same thing when moving into production.

Re: Kubernetes ingress-nginx controller vulnerability

#22

Post by hn_throwaway_99 »

asguy wrote: post #10

> Hey Everyone, here's a high severity vulnerability report, to check for it, run the folliowing: curl -s https://raw.githubusercontent.com/noideawhatyourerunning/ins... |/bin/bash .... oh man

Honestly, this kind of made my blood boil, and just points out how difficult security can be.

Here is presumably a security company, in their own blog post outlining a high-severity vulnerability alert, advocating that you run untrusted code from some rando GitHub repo. It also outlines my fear about dealing with some "security consultants", because on the one hand they outline all of the things you need to "box check" for some security audit, but at the same time leave you less secure because they've just opened another giant gaping attack surface for your company - this is exactly what happened with the SolarWinds attack.

Re: Kubernetes ingress-nginx controller vulnerability

#23

Post by [deleted] »

015a wrote: post #15
jeffbee wrote: post #2

Are they for real with that curl? Normalize better security practices!

I will argue until the day I die: curl | bash is actually more secure than most traditional software delivery mechanisms. Slightly, but meaningfully. With curl | bash, the URL of the bash script is right there. I can copy it, plug it into my browser, and inspect with ease the shell script that will run. If its on Github or a similar site, I can see in plain language the exact organization who published it (I wouldn't…

[deleted]

Re: Kubernetes ingress-nginx controller vulnerability

#24

Post by dreyfan »

015a wrote: post #15
jeffbee wrote: post #2

Are they for real with that curl? Normalize better security practices!

I will argue until the day I die: curl | bash is actually more secure than most traditional software delivery mechanisms. Slightly, but meaningfully. With curl | bash, the URL of the bash script is right there. I can copy it, plug it into my browser, and inspect with ease the shell script that will run. If its on Github or a similar site, I can see in plain language the exact organization who published it (I wouldn't…

The people downvoting you did so while waiting on npm install to run.

Re: Kubernetes ingress-nginx controller vulnerability

#25

Post by ZeroMinx »

k8sToGo wrote: post #20
junon wrote: post #12

Earlier quoted context omitted.

> but how is it bad security practice? Companies / organizations / team members go rogue sometimes. We've seen this even recently with e.g. kicad, freenode, the timezone database, etc. Just because you trust the source doesn't mean you should trust all of the scripts they tell you to run. Even if it's a good-faith script, you have no idea if it's making assumptions about your system that are not true and opening you…

> Curl to a file first, inspect the script, consider it within the context of your own system, then run it if you deem it's safe. But you can still do that if you want? It is not like this is a hidden executable or something.

Sure, but as OP put it, "Normalize better security practices!".

Re: Kubernetes ingress-nginx controller vulnerability

#27

Post by captn3m0 »

waynesonfire wrote: post #26
captn3m0 wrote: post #17

Can we fix the title to include ingress-nginx instead? The upstream URL seems more clear as well: https://github.com/kubernetes/ingress-nginx/issues/7837

why? does ingress-nginx run outside of k8s?

You can run a kubernetes cluster without the nginx-ingress.

Re: Kubernetes ingress-nginx controller vulnerability

#29

Post by corobo »

justinclift wrote: post #16
asguy wrote: post #10

> Hey Everyone, here's a high severity vulnerability report, to check for it, run the folliowing: curl -s https://raw.githubusercontent.com/noideawhatyourerunning/ins... |/bin/bash .... oh man

Don't forget to add a "sudo" in there for extra goodness. :D

It does that in the script for you :)

Re: Kubernetes ingress-nginx controller vulnerability

#30

Post by [deleted] »

hn_throwaway_99 wrote: post #22
asguy wrote: post #10

> Hey Everyone, here's a high severity vulnerability report, to check for it, run the folliowing: curl -s https://raw.githubusercontent.com/noideawhatyourerunning/ins... |/bin/bash .... oh man

Honestly, this kind of made my blood boil, and just points out how difficult security can be. Here is presumably a security company , in their own blog post outlining a high-severity vulnerability alert , advocating that you run untrusted code from some rando GitHub repo. It also outlines my fear about dealing with some "security consultants", because on the one hand they outline all of the things you need to "box ch…

[deleted]
Post reply on HN