11–20 of 56 posts
That's really neat. Cloudflare tunnel for external customer egress, and Tailscale for internal tool egress. No more costly cloud specific load balancers !
The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash.
If I were TAO I'd apply for a job at Docker or their hosting provider.
The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.
And that's why I have an in-between step.
Harbor.io allows you to configure it as a proxy with approval mechanism and cve scanning
The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.
That's why you only pull official images and signed ones. And that's why I have an in-between step. Harbor.io allows you to configure it as a proxy with approval mechanism and cve scanning
We won't even do this for webpages, but we find it a fine default for code that executes inside critical infrastructure.
It's utter madness. Cool to see someone is doing something about it.
Currently there's no way to have two proxies that listen on the same tailscale hostname/ip
Ideally in Kubernetes every pod is redundant to allow downscaling of nodes efficiently, so this means we have to eat a minute or so of downtime randomly every now and then on our tailscale endpoints
The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.
Auth providers (OIDC), cloud providers, and numerous software repositories and SaaS providers effectively have root on the entire universe. A major compromise of any number of these large vendors could expose millions of systems to total compromise.
That's really neat. Cloudflare tunnel for external customer egress, and Tailscale for internal tool egress. No more costly cloud specific load balancers !
You can use Cloudflare access for internal which is tunnel + identity access management for end users.
The amount of trust placed in DockerHub to serve the correct images to everyone for uncritical download and execution is insane to me. The whole industry does it, and it's the same as "curl | bash" to specify image:tag and not image@hash. If I were TAO I'd apply for a job at Docker or their hosting provider.
We have collectively decided as an industry to place infinite trust in a handful of vendors for the sake of convenience. Auth providers (OIDC), cloud providers, and numerous software repositories and SaaS providers effectively have root on the entire universe. A major compromise of any number of these large vendors could expose millions of systems to total compromise.