4 ms·

Reply to the edited comment: The reasoning that "more layers of abstraction necessarily equals less security" does not seem true to me. Granted, it increases t

Reply to the edited comment: The reasoning that "more layers of abstraction necessarily equals less security" does not seem true to me. Granted, it increases the "surface area" that is exposed to attacks, and there's indeed a tradeoff involved, but this tradeoff may swing either way - either it does pay off or not. Taking this reasoning to the extreme, there are plenty of abstractions that pay off for secutiry. One simple example is that software written in Java (for example) is by default more buffer-overflow-resistant than software written in C, due to managed memory/bounds-checking. In this case, the tradeoff was performance vs security. > How could adding a ton of abstraction (which grows every release) making something more secure? One example is the "buffer overflow resistence" in Java vs C mentioned above.

merb 10y ago
Actually we are a 100% Java Shop but the JVM has a lot of Bugs, Bugs that you won't have in C. Yes you can run into your own code smell, Bugs or whatever, but the same could happen on Java, too. The biggest problem with docker is the tone of stuff they try to put into. While most stuff is just possible without docker and the big abstraction. Hell you can start your programs under Linux with user namespaces just without docker. Actually trust me it's way easier to control a single stack instead of managing a stack on top of another. Especially networking is no fun. Maybe it's cool and easy / shiny if you can have everything in the cloud, but that just won't apply to everybody.
- ralmeida 10y ago
  > the JVM has a lot of Bugs, Bugs that you won't have in C There will be different classes of bugs, of course, but I find it hard to believe that it will be more bugs, or more serious bugs, or most costly-to-fix bugs. Otherwise, your own company would have decided to use C instead of Java, right? > Hell you can start your programs under Linux with user namespaces just without docker Sure you can, but if Docker (or any other solution, for that matter) makes it easier or faster to do that, more people would do that. There's a more or less fixed number of work units to dedicate on a certain project, if you have to use them all to set up security solutions, your lunch will be eaten by other people. > most stuff is just possible without docker and the big abstraction Most stuff is "just possible" without any abstraction at all. However, one has to learn to leverage abstracted-away stuff, otherwise one will spend a lot of time and accomplish very little valuable stuff. > trust me it's way easier to control a single stack instead of managing a stack on top of another Easier does not equal safer, faster, or more business-valuable. > it's cool and easy / shiny if you can have everything in the cloud Not sure where "the cloud" enters the equation? You can use Docker (or whatever else) to manage even your on-premises stack. --- I don't know the specifics of your situation at all, but if your only argument against a particular piece of tech is "it abstracts away stuff, therefore it is worse", you might want to consider some self-reflection on whether you're not just suffering of NIH Syndrome (https://en.wikipedia.org/wiki/Not_invented_here https://en.wikipedia.org/wiki/Not_invented_here)

merb 10y ago

Actually we are a 100% Java Shop but the JVM has a lot of Bugs, Bugs that you won't have in C. Yes you can run into your own code smell, Bugs or whatever, but the same could happen on Java, too. The biggest problem with docker is the tone of stuff they try to put into. While most stuff is just possible without docker and the big abstraction. Hell you can start your programs under Linux with user namespaces just without docker. Actually trust me it's way easier to control a single stack instead of managing a stack on top of another. Especially networking is no fun. Maybe it's cool and easy / shiny if you can have everything in the cloud, but that just won't apply to everybody.

ralmeida 10y ago
> the JVM has a lot of Bugs, Bugs that you won't have in C There will be different classes of bugs, of course, but I find it hard to believe that it will be more bugs, or more serious bugs, or most costly-to-fix bugs. Otherwise, your own company would have decided to use C instead of Java, right? > Hell you can start your programs under Linux with user namespaces just without docker Sure you can, but if Docker (or any other solution, for that matter) makes it easier or faster to do that, more people would do that. There's a more or less fixed number of work units to dedicate on a certain project, if you have to use them all to set up security solutions, your lunch will be eaten by other people. > most stuff is just possible without docker and the big abstraction Most stuff is "just possible" without any abstraction at all. However, one has to learn to leverage abstracted-away stuff, otherwise one will spend a lot of time and accomplish very little valuable stuff. > trust me it's way easier to control a single stack instead of managing a stack on top of another Easier does not equal safer, faster, or more business-valuable. > it's cool and easy / shiny if you can have everything in the cloud Not sure where "the cloud" enters the equation? You can use Docker (or whatever else) to manage even your on-premises stack. --- I don't know the specifics of your situation at all, but if your only argument against a particular piece of tech is "it abstracts away stuff, therefore it is worse", you might want to consider some self-reflection on whether you're not just suffering of NIH Syndrome (https://en.wikipedia.org/wiki/Not_invented_here https://en.wikipedia.org/wiki/Not_invented_here)