121–130 of 269 posts
Their hub website is pretty bad. I tried changing the password and the website came back with an error: Failed to save password. Interesting, so I tried again. This time it said: Current password is incorrect. I thought, maybe I need to log out and try if the new password works. I clicked on Log Out link, the website has refreshed and I was still logged in.
Earlier quoted context omitted.
How could one verify ?
You can't. Not without end-to-end integrity with nonrepudiation. Checksums aren't anywhere near enough. But that's Docker.. security optional and run random, untrusted code from the internet.
Why not?
Imagine the impact if NPM got hacked instead of Docker Hub. People would go crazy, run the streets like monkeys and yelling why NPM is untrustworthy must be boycotted. Last time one user got hacked and they blamed NPM for letting it happened. Everyone went crazy...
NPM is bad because the Javascript ecosystem is fast-moving with loose builds that have thousands of dependencies that are all bundled and run insider consumer's browsers.
I did not get any email but my github is showing dozens of failed login attempts over the last 3 days.
Sending 190k emails takes time but please update us here if you don't receive in a day or so. - curious if their 190k is accurate or downplay spin.
If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…
Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?
If you got an email you should: - Change your password on https://hub.docker.com - Check https://github.com/settings/security - Reconnect oauth for Automated Builds - Roll over effected passwords and API keys stored in private repos / containers Quick take: - Password hashes - Github tokens - Bitbucket tokens - Your Automated Builds might need new tokens Checking my github logs - It looks like they've known about thi…
Can I complain a bit about GitHub? Why I can only authorize my entire GitHub account for third-party access? Could things be slightly better if the authorization is done at repository level?
Earlier quoted context omitted.
> Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware. I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how t…
That's a strawman because the shriekingly-obvious difference is ease of facilitation. With Docker, it's a mere couple of commands to pull a box and run it. Docker weakens trust because it lets anonymous people, as well as trusted ones, upload images that can be immediately run... but without a proper chain-of-custody, QA or assurance that an image hasn't been manipulated on Docker's side. It's spray-and-pray DevOps.…
How is this github any different?
Earlier quoted context omitted.
> Docker is an invitation to trouble. Anybody can publish a binary blob, and users are expected to blindly trust it How is this issue specific to Docker? Anyone can download a random library off github, use a shady linux distribution, or install utility tools loaded with spyware. I don't think Docker aims to solve issues relating to trusting upstream software. It's a tool to help package applications, just like how t…
Libraries off Github literally have the source available for you and the community at large to vet. And you'll find almost no sane shop on the planet where people are allowed, hell encouraged to use shady distros or install random utility tools in production the way they are encouraged to pull unchecked binary blobs from Docker Hub in an often non-reproducible manner.
If Github was compromised, it would be easy and obvious to insert malicious code in a repository, but hide those changes from anyone on the github website.
Earlier quoted context omitted.
Fun fact, there was a universal XSS vulnerability on google (including search, support, accounts, cloud, etc) found just last week [0]. I'd say it's always just a matter of time. That doesn't mean they don't have everything in order, but securing everything as much as possible is half the battle. The other half is a solid response when things do happen, which we will now see in how Docker handles this situation. [0]…
“We are enhancing our overall security processes and reviewing our policies. Additional monitoring tools are now in place.” Why wasn’t that the case before?!
There's always a way to enhance your processes, monitor more indicators, etc. or otherwise improve your security.
Earlier quoted context omitted.
Pretty sure (don't quote me) those are read only and repo specific but that could contain all sorts of juicy info depending how lax you are with security of configs in private repos. Even then just read access to code often allows enough info for leveraging/escalating privilege.
When you connect your Github account to Docker Hub, that will give DH full access to all repos ( https://i.imgur.com/4jJWrez.png ). I'm not even sure if Github's permission model supports adding only read access to private repositories. I'm not 100% sure if Docker hub uses deploy keys for repos it has access to thru the integration, but at least previously there was an option to manually add one to repository if it c…
Their newer GH apps permission model allows fine-grained access to only specific repos (and also only read access e.g.). However their older Oauth flow only allows full access to everything. And 99% of GH integrations still seem to use the older authentication method.
This is also something that many CI providers suffer from. There are only few that already support GH apps.