Earlier quoted context omitted.
What ladder are they pulling up? Feel free to fork the last valid commit and make a competitor.
The ladder is still there! See that pile of wood there? That's where we put the rungs. And if dig in that hole over there you might even find the extension we removed last week...
MinIO stops distributing free Docker images
551–560 of 585 posts
Re: MinIO stops distributing free Docker images
#552Earlier quoted context omitted.
> half the price of S3 No one other than hobbyists is paying full price on AWS.
How to not pay full price on AWS? We pay $10K+ per month and nobody gives us any discount.
Re: MinIO stops distributing free Docker images
#553Earlier quoted context omitted.
Zero trust is the way to assess threat. Not Internet access or not.
No, it is a defense strategy. For e.g. hobbyists, it's basically irrelevant, and having something on a private LAN is fine. There is almost no chance of an issue. Not everything in the world needs to be maximally secured, and the people who are using those IAM policies are probably not pulling a vanilla image off Dockerhub to run something as fundamental as their storage layer. They probably also have firewalls tight…
That's because of two things. The first is, assessment takes a deep dive into the issue, not a summary. Conjoined with the second, in that you must be ready to update if required, without issue.
In every case, it's less time cost even for home lab users to update instead of assess.
If it isn't, you're using terrible software, for example software which pushes security updates along with API and code changes. Such software doesn't take user security seriously, and should be avoided at all costs.
There's no way around it. Just do it right, don't half ass with excuses. Don't use terrible software. If it's plugged into a network, zero trust it is.
Re: MinIO stops distributing free Docker images
#554Re: MinIO stops distributing free Docker images
#555Earlier quoted context omitted.
There are a ton of different discount options - large customers typically get between 50-60% discount based on committed spending, and AWS is pretty flexible around how that commit lands (they will allow roll overs even if they say they won't). Reserved instances get you ~70% discounts - similar to the committed spending. And my favorite - if it works for you - spot instances on EC2 come at as high as 90% off. Nobody…
How about S3? I haven’t personally seen them price that so aggressively but I have a limited sample set.
Re: MinIO stops distributing free Docker images
#556Earlier quoted context omitted.
"That expectation does not entitle anybody to anything though." This is true legally, but not otherwise (socially, practically) "That is their decision. Without any contract or promise, there is no obligation to anybody." Again, true legally, but IMHO a really silly position to take overall. Imagine I provide free electricity to everyone in my town. I encourage everyone to use it. I do it all for free. I'm very caref…
Sticking with your analogy -- your townsfolk getting energy for free. As rational people they must include the possibility of free service being over at any time in their planning and act accordingly. Otherwise they're just freeloading.
It's fair in the singular case (IE if this is the only open source/free thing you use), but especially as you are dealing with more and more things like this (IE use lots of open source), it is totally irrational to expect them to plan for any of 50 open source projects they use to stop at any time.
It violates general good faith expectations. Just because someone is doing something for free doesn't mean you expect them to fail or stop - The cost is fairly orthogonal to most people's expectations. I don't expect any package in my linux distro to just stop existing or working at any time.
Sure, it would be sensible to plan for eventual failure of things you depend on, but it's not rational to expect people to plan for random failure of any of the things they depend on at any time, regardless of the cost of those things.
More to the point, it's not entitlement on their part to avoid sitting around waiting for the other shoe to drop all the time :)
The projects also often have the perspective of "it shouldn't be tha big a thing" but that's because they ignore they are not the only thing happening in their users world.
Re: MinIO stops distributing free Docker images
#557Earlier quoted context omitted.
"That expectation does not entitle anybody to anything though." This is true legally, but not otherwise (socially, practically) "That is their decision. Without any contract or promise, there is no obligation to anybody." Again, true legally, but IMHO a really silly position to take overall. Imagine I provide free electricity to everyone in my town. I encourage everyone to use it. I do it all for free. I'm very caref…
> Again, true legally, but IMHO a really silly position to take overall. Is it? Let's take a look at the opposite scenario: What if MinIO never released any source code at all? They'd be just another 100% proprietary company like any other and would have never received any backlash for "pulling up the ladder behind them". So offering something for free and then rescinding later is treated worse than never offering an…
This is true plenty of times. In particular, if you violate social expectations/etc, you will often see this.
For example, here's an easy case:
I am about to go plant a bunch of trees.
A neighbor sees me going to do it, and offers to do it for me for free, because they like to do it.
I say cool. They can even say "just so you know, i'm not your contractor, blah blah blah" or whatever. Doesn't matter.
I go do something else with my time.
A week later, they did half the job, and quit, or they did the whole job and made a hash of it, or whatever.
1. It wouldn't make sense for me to expect them to fail or stop doing it or do it poorly just because it was free. Nor plan for them to fail.
2. Most people would still complain even though they paid nothing, and are arguably no worse off (depending on the options you pick) then when they started.
3. Most people would definitely feel like it was worse than doing nothing.
Now, in this example you could argue it's the poor quality/stopping halfway through that is causing this result, but you would IMHO see the same result even if they did a great job, but stopped after doing 90% of it, leaving me definitely no worse off, and probably much better off.
In the end, people's expectations are emotional and not simply rational.
Re: MinIO stops distributing free Docker images
#558I'll let docker's security team know that an insecure, obsolete docker image is being served and the maintainers have officially acknowledged they will no longer support it. Best to get insecure and vulnerable software out of the hands of those who may not be familiar with this CVE or their change in policy that has not gotten a press release in any way.
"Hello,
This does not qualify as an infringement to our Terms of Use policy. Deprecating such images and repo(s) is the responsibility of the owner and we recommend you reach out to them. Docker advises its users to opt into using images under our official programs and offerings such as Docker Official Images and Docker Hardened Images.
Thank you, Security@Docker"
In their ToU under section 6.6, they outline how they may scan images for vulnerabilities and request the owners of said packages fix it, or simply remove it from their site. They clearly do not do this though even when notified of the high criticality vulnerability.
Re: MinIO stops distributing free Docker images
#559Earlier quoted context omitted.
We had some neighbors that used it throw a big Halloween celebration. They gave out drinks and snacks, dressed up in very elaborate costumes, setup movies on outdoor projectors, and do hayrides. They didn’t do it last year. I was disappointed, but I’m not angry at them. I realize that they were spending a lot of time and energy and maybe they are just burned out. I’m sure there are people who are angry and judge them…
If people were depending on the party for very important things, and the neighbors encouraged it, and gave no warning, then it would be fine to get angry.
Re: MinIO stops distributing free Docker images
#560Earlier quoted context omitted.
If people were depending on the party for very important things, and the neighbors encouraged it, and gave no warning, then it would be fine to get angry.
If you’re depending on the party for very important things you need to ask the neighbor how long they promise to keep throwing the party. You don’t just get to assume they’re going to do it literally forever and get mad when they stop.
And, reminder, they keep encouraging people to use the party as an important foundation for their own efforts.
Does that help explain why a sudden stop is causing harm to people that weren't being greedy? At which point anger is not an inherently bratty behavior.