Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We eliminated 1,400 CVEs in NanoClaw's container images

echo.ai

Post reply on HN
Print view View original

41–50 of 54 posts

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#41

Post by chrismorgan »

lokar wrote: post #17
aliasxneo wrote: post #9

I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.

My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.

I don’t say it’s the case there (it probably isn’t, you probably need hardware access or root), but sometimes those sorts of things do actually matter because there’s a way of causing them to be run anyway.

This is why it’s good to exclude things you don’t need. The less there is, the fewer places there are for problems to lurk.

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#42

Post by paulryanrogers »

nathancahill wrote: post #10
aliasxneo wrote: post #9

I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.

This is how Vanta et al. make millions.

I don't think Vanta itself even scans for CVEs? They scan for compliance which includes tooling that may look for CVEs, like Dependabot.

Scanning companies should be sophisticated enough to distinguish invalid CVEs and back ported fixes.

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#45

Post by lokar »

chrismorgan wrote: post #41
lokar wrote: post #17

Earlier quoted context omitted.

My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.

I don’t say it’s the case there (it probably isn’t, you probably need hardware access or root), but sometimes those sorts of things do actually matter because there’s a way of causing them to be run anyway. This is why it’s good to exclude things you don’t need. The less there is, the fewer places there are for problems to lurk.

Not against fixing it, but at the next normal update, it an emergency.

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#46

Post by lokar »

sriram_sun wrote: post #36
lokar wrote: post #17

Earlier quoted context omitted.

My favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.

Why is that even part of the image?

It was a stock/default kernel setup, before my time.

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#47

Post by r14c »

TZubiri wrote: post #39
stavros wrote: post #34

Earlier quoted context omitted.

Security isn't binary. There's nothing that's "secure" unless you define a threat model first.

Sounds like the kind of stuff devs that introduce security vulnerbilities say.

if you can't define a threat model, or know why you need one, you will write vulnerable code.

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#49

Post by evanjrowley »

prymitive wrote: post #25

For those unfamiliar, “CVE” stands for “CV Enrichment”, common slang in Posture Engineering

Discovered a new legit CVE today during a meeting with some other engineers. I’m going to make sure the one who originally brought it up gets to put it on his résumé. The world needs more people like that.

Re: We eliminated 1,400 CVEs in NanoClaw's container images

#50

Post by EdwardDiego »

bedros wrote: post #44
prymitive wrote: post #25

For those unfamiliar, “CVE” stands for “CV Enrichment”, common slang in Posture Engineering

Common Vulnerabilities and Exposures https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exp...

I feel you missed the joke.
Post reply on HN