14 ms·

Why we started CoreOS

168 points by philips 9y ago

sargun 9y ago
Usually blog posts like this come at pivotal times in a company's lifetime. There doesn't seem to be anything yet. Interesting.
- throwaway7645 9y ago
  My guess is it's easier to get attention for selling cloud security after something like the Equifax breach happens.
pm90 9y ago
While admirable, I don't really see how CoreOS automatically makes the internet more secure as they claim. I'm assuming this blog is targeted at other tech folks so definitely expected a little more detail than a small blurb. I say this as fan of CoreOS and really appreciate their OpenSource work.
- philips 9y ago
  In a few words. With CoreOS Tectonic we are reducing the toil teams endure to update both application infrastructure and applications. We believe that security begins with a simple regular processes for getting updates to software out the door and that our tools and products remove toil from these processes. Two sides of the problem: Infra: CoreOS Tectonic[1] provides one-click updates of the entire app infra stack from the VM/bare-metal Linux instances[2] through the Tectonic control plane including Kubernetes, identity services, monitoring tooling, etc[3]. We call this automated operations. App: By leveraging Kubernetes APIs application teams can roll. Further container scanning tools enable app teams to scan in-use containers for CVEs. [1] https://coreos.com/tectonic https://coreos.com/tectonic [2] https://coreos.com/blog/introducing-container-linux-update-operator https://coreos.com/blog/introducing-container-linux-update-o... [3] https://coreos.com/blog/announcing-tectonic-1.7.1 https://coreos.com/blog/announcing-tectonic-1.7.1
  - 3D5AE1F1 9y ago
    A few years ago I worked at a big company that desperately needed something like this. Without it we more than did our part to make the internet less secure. Without containers, software releases and infrastructure upgrades were highly interdependent. The result was that the software never released and the infrastructure never got upgraded. Being able to upgrade individual services, independently of the infrastructure, is a bigger enabler than you would think in a large company. When you enable this, teams are suddenly able to release more often. Features ship faster and the lifetime of application vulnerabilities shortens. Meanwhile, if Tectonic works as advertised, your infrastructure can auto-update but continue to provide a stable API to the services it supports. Again, the lifetime of vulnerabilities shortens, potentially by a lot.
  - nwmcsween 9y ago
    This is imo a backwards way of doing things properly. Binaries should be sandboxed via a .ctor using seccomp and unshare, preferably in their own section so updating or removal is trivial. The remaning issue is "how can you have multiple tools as an all-in-one container"
- cyphar 9y ago
  Their measurement and TPM support is probably the best in the industry at the moment. Matthew Garrett worked for them on this, and effectively you can have completely measured boot of a system and the containers running on it. With IMA this would allow you to have systems that cannot run binaries that are not signed (the kernel simply wouldn't allow it).
the_common_man 9y ago
This looks like some epic PR talk for marketing purposes. Maybe they want to sell it to Equifax like companies?
- 1_2__4 9y ago
  And likely not letting a crisis go to waste.
alphabettsy 9y ago
I like their product, but evoking the founding fathers of the US and MLK in talking about a more secure OS seems a bit much.
- devcamcar 9y ago
  You're not wrong - this is pretty cringeworthy.
  - Rapzid 9y ago
    It's no mystery what's wrong with Equifax to those who have accounts with all three bureaus. Two seconds inside the site will tip you off; hint, it's much higher level than choice of hosting platform. CoreOS is certainly trying to get on the radar here for when the other shoe drops and Equifax starts spending serious money on this stuff. The whole thing seems a bit tone deaf in timing though.
- simonh 9y ago
  You wouldn't think that patching a Java web framework could protect the personal financial information of millions of Americans, but here we are. Security matters. I used the work in the IT department at an environmental research agency here in the UK. I took enormous pride in the quality and importance of the research conducted by the people I worked with even though I just helped them work more easily with better tools.
- curun1r 9y ago
  It does evoke the brilliant: "We're making the world a better place through constructing elegant hierarchies for maximum code reuse and extensibility." It's a infrastructure piece, which is several abstraction layers below the things that do impact freedom and all the other abstract values that high school LD debaters love to talk about. That they continue to parrot the "just missed a security update" view of the Equifax hack is both sad and makes me highly doubt their security acumen. True security relies on layers, not an impenetrable outer shell. Equifax's blunder was a fundamental lack of security-conscious architecture, not a failure to install a security update. I'm guessing that CoreOS actually understand this, they're just trying to profit from an event that's going to have real negative consequences for a lot of people who's information was stockpiled without their consent, which is a pretty crappy thing to do.
siliconc0w 9y ago
An auto-updating OS doesn't really help you with web application vulnerabilities. Even something like Clair would be unlikely to help - they likely knew about the numerous struts vulnerabilities they faced and simply chose not to care (and prioritize other more exciting business prospects - like selling identity theft protection)
- deleted 9y ago
  [deleted]
hedora 9y ago
"Install kubernetes in 15 minutes or less -> bare metal" leads to this: https://coreos.com/tectonic/docs/latest/install/bare-metal/requirements.html https://coreos.com/tectonic/docs/latest/install/bare-metal/r... There are over 15 non-trivial subtasks there (counting "foo and bar" under one bullet as two subtasks). Worse, this is just prerequisites for before the actual installation! I really want something like what CoreOS claims to be to exist, but always feel like the victim of some inside joke when I actually try to install it. Does anyone know of any alternatives that can be setup in a matter of hours and not days?
- cyphar 9y ago
  Big disclaimer, I work for SUSE on the team for this product (though I actually work on upstream projects more than the product itself). SUSE's "Container as a Service Platform"[1] has a one-page install for each node with an admin panel that does auto-provisioning. It also has transactional updates and a few other nice features similar to CoreOS's "Container Linux". In addition, we're working on openSUSE Kubic[2] which will be the community-developed base for CaaSP in the future. I believe most if not all of the code is available on GitHub[3] under a free software license (because that's how we do things). Not to mention that you could very easily fork openSUSE Kubic, once it's ready. [1]: https://www.suse.com/communities/blog/introducing-suse-containers-service-platform/ https://www.suse.com/communities/blog/introducing-suse-conta... [2]: https://news.opensuse.org/2017/05/29/introducing-kubic-project-a-new-open-source-project/ https://news.opensuse.org/2017/05/29/introducing-kubic-proje... [3]: https://github.com/kubic-project https://github.com/kubic-project
  - rjzzleep 9y ago
    Given that you work for SUSE and I kinda like you guys, I really hope that it's different from SLES licensing model. I work at a german govt. institution which uses SLES and we've recently decided to move away from SLES for a simple reason. If you want to use something like immutable infrastructure SLES is painful to use, because you need to do everything through the SMT admin. You won't even know which packages are available in SLES until you signup for it. Sure you can use openSUSE, but it's not the same packages, it's not the same package versions, and the open repo, while nice, is imho not as comfortable to use as ubuntu packages. IMHO it's not very user friendly. And yes yast2 is great, but I'm not talking about graphical user interfaces when I say user friendly. By the way, there are a few more "ContainerOSs" than just CoreOS nowadays. - There's project atomic [1] which became atomic host [2] - There's RancherOS, which I find interesting because it seems to have first class zfs support [3] [1]: http://www.projectatomic.io/docs/kubernetes/ http://www.projectatomic.io/docs/kubernetes/ [2]: https://www.redhat.com/en/resources/enterprise-linux-atomic-host-datasheet https://www.redhat.com/en/resources/enterprise-linux-atomic-... [3]: http://rancher.com/docs/os/v1.0/en/storage/using-zfs/ http://rancher.com/docs/os/v1.0/en/storage/using-zfs/
julianhouston12 9y ago
Hi My name is Julian Houston, am from upper island cove , Canada.. I want to Use this opportunity to thank God for using this Great prophet to solve my Marriage problem. This Great Prophet of God brought my husband back to me. 3 years ago, i and my husband has been into one quarrel or the other until he finally left me for one lady. I felt my life was over and my kids thought they would never see their father again. I tried to be strong just for the kids but i could not control the pains that was tormenting my heart. My heart was filled with sorrows and pains, because i was really in love with my husband. Every day and night i think of him and always wish he would come back to me. Until one day i melt a good friend of mine that was once in my situation, but her problem was different a little bite, her ex-boyfriend who she had an unwanted pregnancy for refused to take responsibility and dumped her. She told me that mine issue was a minor case and that i shouldn't worry about it at all. So, i asked her what was the solution to my problems and she gave me this Great Prophet of God phone number and his email address. I was doubting if this Great Prophet of God could actually solve my problem. So, I contacted this Great Prophet of God and he told me what to do and i did it. He told me to wait for just four days and that my husband will come crawling on his kneels just for forgiveness. So, I faithfully did what this Great Prophet of God asked me to do and for sure after four days i heard a knock on the door, in a great Surprise i saw him on his knees and i was speechless, when he saw me, all he did was crying and asking me for forgiveness, from that day, all the pains and sorrows in my heart flew away, since then i and my husband and our lovely kids are happy. That why i want to say thank you to God for using Prophet Ikehedu .to solve my marriage problem. This Great Prophet of God made me to understand that there’s no problem on earth that does not Have solution. So, if you are having same problem, any problem that is Similar, i will advise you to a contact This Great Prophet of God straight At prophetikehedu@gmail.com
arianvanp 9y ago
I disagree with this article. Coreos wouldn't have helped at all in this particular case. First of all, struts is not a system dependency. So it wouldn't be auto updated. Well okay, how about Claire, the vulnerability scanner? It scans container layers, aka system dependencies. They don't scan your maven dependencies.(maybe I'm wrong here). So your entire security relies on someone not updating dependencies for a project often. Which was already the case. What did we gain? In this particular case, nothing Of course kubernetes makes rolling out updates a lot easier. And thus a team might patch often. But that is not the OS. Of course for system level security vulns, coreos is great and on the right track. But saying they would have caught Equifax is a big stretch. Equifax was not a big hack with multiple zero days. It was a team who didn't update their application.
bogomipz 9y ago
If Equifax were running a vulnerable version of Apache Struts on CoreOS the the hack would have still happened. That the CoreOS CEO has chosen to use the Equifax hack as a marketing opportunity is equally distasteful and disingenuous. Also invoking the founding fathers, the Bill of Rights and the great Dr Martin Luther King in the as part of that marketing pitch is the height of bombast and absurdity. This blog post could have been written by Gavin Belson.
- deleted 9y ago
  [deleted]
- sheeshkebab 9y ago
  It depends on the base docker image this struts2 web app would run on, and whether it would allow running OS commands involved into the hack, but yeah, coreos/tectonic is not exactly known for any security features that would have helped with this.
- StefanKarpinski 9y ago
  One of the features of their stack is live single-click or even auto-update of you technology stack while your application keeps running. While that doesn't necessarily mean that you will keep your stack up-to-date, it makes patching security issues considerably easier and less painful, which means it's far less likely that you will be running a known-vulnerable version. So it's not entirely BS, even though why CoreOS helps security isn't spelled out here. I happen to have watched a talk where Alex Polvi did spell this out just last night, which is the only reason I know this. But yes, the rhetoric is a bit heavy-handed.
  - oso2k 9y ago
    This is built-in functionality of Kubernetes (& OpenShift) called Rolling Update [0]/Rolling Deployments [1] and Image Triggers [2]. [0] https://kubernetes.io/docs/tasks/run-application/rolling-update-replication-controller/ https://kubernetes.io/docs/tasks/run-application/rolling-upd... [1] https://docs.openshift.com/container-platform/3.6/dev_guide/deployments/deployment_strategies.html#rolling-strategy https://docs.openshift.com/container-platform/3.6/dev_guide/... [2] https://docs.openshift.com/container-platform/3.6/dev_guide/builds/triggering_builds.html#image-change-triggers https://docs.openshift.com/container-platform/3.6/dev_guide/...
DCKing 9y ago
I like CoreOS, and I know this is some post that is meant for marketing purposes. But it's a shame they're propagating a myth that good security is the result of good tools. It's a common fallacy to think that these security problems have a technical solution first. They don't. CoreOS makes tools that helps security aware companies/organizations implement security, but being sufficiently security aware is the first step. Buying and using CoreOS products and support does not help you anything if you don't know how to use it well, or if your organization doesn't allow the engineers to use them effectively. It's become abundantly clear that mismanagement is the root cause of the Equifax hack, and that the vulnerable Struts server is just a symptom of it. A fool with a tool is still a fool. It's attractive to think CoreOS's products, or some other vendor's product, would have avoided this. But given the mismanagement it seems unlikely, and at best it would have just plugged a hole until another one popped up at some later time. Who knows that they already plugged some earlier worse holes with some other security products. Making the tools to make the internet more secure is the easy part. The hard part is getting everyone to use them in the right way. If tools and only buying things were the answer, the internet would have been a much more secure place already. So keep doing you CoreOS, keep making those tools. But please don't oversell yourself.
peatfreak 9y ago
"At CoreOS, our aim is to arm these companies with the tools to build their cloud services – and run our digital lives – correctly. We’re also dedicated to making it so easy to run these highly complex systems that they take care of themselves. What if they’ll never miss an update again. They’ll have all the security features turned on by default and new versions of applications will ship quickly and safely." What a load of absolute dreck this article is.
devonkim 9y ago
For everyone criticizing this because there's not much actual substance, I'm fairly certain this piece wasn't aimed at you - it was aimed at people that get taken by this kind of rhetoric over actual technology. If it comes down to the usual players in enterprise software or CoreOS / Tectonic, I'd be perfectly happy to see that stack as an option in the F500. I'm sure there's a lot of reservations we all have about the tone and content, but as long as the fundamental goal isn't just selling I can let it slide.
- deleted 9y ago
  [deleted]
flashdance 9y ago
> I believe in freedom. Founding fathers, Martin Luther King, Jr. – that kind of freedom. It’s the same kind of freedom that motivates my passion for free software. Oh boy, this CEO is laying it on pretty thick here... I'm a pretty steadfast advocate for free software--and I think open software does make a better society--but even then, I think it's a bit strange to use a comparison to MLK for something that seems an order of magnitude less important. It's giving me serious flashbacks to Silicon Valley. https://www.youtube.com/watch?v=J-GVd_HLlps https://www.youtube.com/watch?v=J-GVd_HLlps
kodablah 9y ago
Off-topic minor note to site owner: You have two shortcut icon references in your head, and one of them references the relative ico/favicon.png which 404's. Chrome falls back but many others do not and you get no favicon.
bashcoder 9y ago
It was my understanding that CoreOS was started as a minimal Linux distro tooled for hosting and orchestrating Docker containers. IMHO, Docker still has a long way to go to impress the security community.
mankash666 9y ago
Why do people lie about founding stories. Most of them boil down to two things: 1> We like making money 2> We enjoy working in the domain the company operates in. Everything else is a usually made up crap for branding, PR and to feed tech journalists.
stevefan1999 9y ago
As far as I know, if a malicious user compromised the CoreOS update central and pushed a new rolling update, then everyone using CoreOS and (presumably automatically) received the rolling update will also be hacked, the end. This is an even bigger evil. It's no difference to a botnet . I don't know if CoreOS has some kind of update signing/verification or what but based on my assertion I wouldn't suggest using it.

168 points by philips 9y ago

Usually blog posts like this come at pivotal times in a company's lifetime. There doesn't seem to be anything yet. Interesting.

throwaway7645 9y ago
My guess is it's easier to get attention for selling cloud security after something like the Equifax breach happens.

pm90 9y ago

While admirable, I don't really see how CoreOS automatically makes the internet more secure as they claim. I'm assuming this blog is targeted at other tech folks so definitely expected a little more detail than a small blurb. I say this as fan of CoreOS and really appreciate their OpenSource work.

philips 9y ago
In a few words. With CoreOS Tectonic we are reducing the toil teams endure to update both application infrastructure and applications. We believe that security begins with a simple regular processes for getting updates to software out the door and that our tools and products remove toil from these processes. Two sides of the problem: Infra: CoreOS Tectonic[1] provides one-click updates of the entire app infra stack from the VM/bare-metal Linux instances[2] through the Tectonic control plane including Kubernetes, identity services, monitoring tooling, etc[3]. We call this automated operations. App: By leveraging Kubernetes APIs application teams can roll. Further container scanning tools enable app teams to scan in-use containers for CVEs. [1] https://coreos.com/tectonic https://coreos.com/tectonic [2] https://coreos.com/blog/introducing-container-linux-update-operator https://coreos.com/blog/introducing-container-linux-update-o... [3] https://coreos.com/blog/announcing-tectonic-1.7.1 https://coreos.com/blog/announcing-tectonic-1.7.1
- 3D5AE1F1 9y ago
  A few years ago I worked at a big company that desperately needed something like this. Without it we more than did our part to make the internet less secure. Without containers, software releases and infrastructure upgrades were highly interdependent. The result was that the software never released and the infrastructure never got upgraded. Being able to upgrade individual services, independently of the infrastructure, is a bigger enabler than you would think in a large company. When you enable this, teams are suddenly able to release more often. Features ship faster and the lifetime of application vulnerabilities shortens. Meanwhile, if Tectonic works as advertised, your infrastructure can auto-update but continue to provide a stable API to the services it supports. Again, the lifetime of vulnerabilities shortens, potentially by a lot.
- nwmcsween 9y ago
  This is imo a backwards way of doing things properly. Binaries should be sandboxed via a .ctor using seccomp and unshare, preferably in their own section so updating or removal is trivial. The remaning issue is "how can you have multiple tools as an all-in-one container"
cyphar 9y ago
Their measurement and TPM support is probably the best in the industry at the moment. Matthew Garrett worked for them on this, and effectively you can have completely measured boot of a system and the containers running on it. With IMA this would allow you to have systems that cannot run binaries that are not signed (the kernel simply wouldn't allow it).

the_common_man 9y ago

This looks like some epic PR talk for marketing purposes. Maybe they want to sell it to Equifax like companies?

1_2__4 9y ago
And likely not letting a crisis go to waste.

alphabettsy 9y ago

I like their product, but evoking the founding fathers of the US and MLK in talking about a more secure OS seems a bit much.

devcamcar 9y ago
You're not wrong - this is pretty cringeworthy.
- Rapzid 9y ago
  It's no mystery what's wrong with Equifax to those who have accounts with all three bureaus. Two seconds inside the site will tip you off; hint, it's much higher level than choice of hosting platform. CoreOS is certainly trying to get on the radar here for when the other shoe drops and Equifax starts spending serious money on this stuff. The whole thing seems a bit tone deaf in timing though.
simonh 9y ago
You wouldn't think that patching a Java web framework could protect the personal financial information of millions of Americans, but here we are. Security matters. I used the work in the IT department at an environmental research agency here in the UK. I took enormous pride in the quality and importance of the research conducted by the people I worked with even though I just helped them work more easily with better tools.
curun1r 9y ago
It does evoke the brilliant: "We're making the world a better place through constructing elegant hierarchies for maximum code reuse and extensibility." It's a infrastructure piece, which is several abstraction layers below the things that do impact freedom and all the other abstract values that high school LD debaters love to talk about. That they continue to parrot the "just missed a security update" view of the Equifax hack is both sad and makes me highly doubt their security acumen. True security relies on layers, not an impenetrable outer shell. Equifax's blunder was a fundamental lack of security-conscious architecture, not a failure to install a security update. I'm guessing that CoreOS actually understand this, they're just trying to profit from an event that's going to have real negative consequences for a lot of people who's information was stockpiled without their consent, which is a pretty crappy thing to do.

siliconc0w 9y ago

An auto-updating OS doesn't really help you with web application vulnerabilities. Even something like Clair would be unlikely to help - they likely knew about the numerous struts vulnerabilities they faced and simply chose not to care (and prioritize other more exciting business prospects - like selling identity theft protection)

deleted 9y ago
[deleted]

hedora 9y ago

"Install kubernetes in 15 minutes or less -> bare metal" leads to this: https://coreos.com/tectonic/docs/latest/install/bare-metal/requirements.html https://coreos.com/tectonic/docs/latest/install/bare-metal/r... There are over 15 non-trivial subtasks there (counting "foo and bar" under one bullet as two subtasks). Worse, this is just prerequisites for before the actual installation! I really want something like what CoreOS claims to be to exist, but always feel like the victim of some inside joke when I actually try to install it. Does anyone know of any alternatives that can be setup in a matter of hours and not days?

cyphar 9y ago
Big disclaimer, I work for SUSE on the team for this product (though I actually work on upstream projects more than the product itself). SUSE's "Container as a Service Platform"[1] has a one-page install for each node with an admin panel that does auto-provisioning. It also has transactional updates and a few other nice features similar to CoreOS's "Container Linux". In addition, we're working on openSUSE Kubic[2] which will be the community-developed base for CaaSP in the future. I believe most if not all of the code is available on GitHub[3] under a free software license (because that's how we do things). Not to mention that you could very easily fork openSUSE Kubic, once it's ready. [1]: https://www.suse.com/communities/blog/introducing-suse-containers-service-platform/ https://www.suse.com/communities/blog/introducing-suse-conta... [2]: https://news.opensuse.org/2017/05/29/introducing-kubic-project-a-new-open-source-project/ https://news.opensuse.org/2017/05/29/introducing-kubic-proje... [3]: https://github.com/kubic-project https://github.com/kubic-project
- rjzzleep 9y ago
  Given that you work for SUSE and I kinda like you guys, I really hope that it's different from SLES licensing model. I work at a german govt. institution which uses SLES and we've recently decided to move away from SLES for a simple reason. If you want to use something like immutable infrastructure SLES is painful to use, because you need to do everything through the SMT admin. You won't even know which packages are available in SLES until you signup for it. Sure you can use openSUSE, but it's not the same packages, it's not the same package versions, and the open repo, while nice, is imho not as comfortable to use as ubuntu packages. IMHO it's not very user friendly. And yes yast2 is great, but I'm not talking about graphical user interfaces when I say user friendly. By the way, there are a few more "ContainerOSs" than just CoreOS nowadays. - There's project atomic [1] which became atomic host [2] - There's RancherOS, which I find interesting because it seems to have first class zfs support [3] [1]: http://www.projectatomic.io/docs/kubernetes/ http://www.projectatomic.io/docs/kubernetes/ [2]: https://www.redhat.com/en/resources/enterprise-linux-atomic-host-datasheet https://www.redhat.com/en/resources/enterprise-linux-atomic-... [3]: http://rancher.com/docs/os/v1.0/en/storage/using-zfs/ http://rancher.com/docs/os/v1.0/en/storage/using-zfs/

julianhouston12 9y ago

Hi My name is Julian Houston, am from upper island cove , Canada.. I want to Use this opportunity to thank God for using this Great prophet to solve my Marriage problem. This Great Prophet of God brought my husband back to me. 3 years ago, i and my husband has been into one quarrel or the other until he finally left me for one lady. I felt my life was over and my kids thought they would never see their father again. I tried to be strong just for the kids but i could not control the pains that was tormenting my heart. My heart was filled with sorrows and pains, because i was really in love with my husband. Every day and night i think of him and always wish he would come back to me. Until one day i melt a good friend of mine that was once in my situation, but her problem was different a little bite, her ex-boyfriend who she had an unwanted pregnancy for refused to take responsibility and dumped her. She told me that mine issue was a minor case and that i shouldn't worry about it at all. So, i asked her what was the solution to my problems and she gave me this Great Prophet of God phone number and his email address. I was doubting if this Great Prophet of God could actually solve my problem. So, I contacted this Great Prophet of God and he told me what to do and i did it. He told me to wait for just four days and that my husband will come crawling on his kneels just for forgiveness. So, I faithfully did what this Great Prophet of God asked me to do and for sure after four days i heard a knock on the door, in a great Surprise i saw him on his knees and i was speechless, when he saw me, all he did was crying and asking me for forgiveness, from that day, all the pains and sorrows in my heart flew away, since then i and my husband and our lovely kids are happy. That why i want to say thank you to God for using Prophet Ikehedu .to solve my marriage problem. This Great Prophet of God made me to understand that there’s no problem on earth that does not Have solution. So, if you are having same problem, any problem that is Similar, i will advise you to a contact This Great Prophet of God straight At prophetikehedu@gmail.com

arianvanp 9y ago

I disagree with this article. Coreos wouldn't have helped at all in this particular case. First of all, struts is not a system dependency. So it wouldn't be auto updated. Well okay, how about Claire, the vulnerability scanner? It scans container layers, aka system dependencies. They don't scan your maven dependencies.(maybe I'm wrong here). So your entire security relies on someone not updating dependencies for a project often. Which was already the case. What did we gain? In this particular case, nothing Of course kubernetes makes rolling out updates a lot easier. And thus a team might patch often. But that is not the OS. Of course for system level security vulns, coreos is great and on the right track. But saying they would have caught Equifax is a big stretch. Equifax was not a big hack with multiple zero days. It was a team who didn't update their application.

bogomipz 9y ago

If Equifax were running a vulnerable version of Apache Struts on CoreOS the the hack would have still happened. That the CoreOS CEO has chosen to use the Equifax hack as a marketing opportunity is equally distasteful and disingenuous. Also invoking the founding fathers, the Bill of Rights and the great Dr Martin Luther King in the as part of that marketing pitch is the height of bombast and absurdity. This blog post could have been written by Gavin Belson.

deleted 9y ago
[deleted]
sheeshkebab 9y ago
It depends on the base docker image this struts2 web app would run on, and whether it would allow running OS commands involved into the hack, but yeah, coreos/tectonic is not exactly known for any security features that would have helped with this.
StefanKarpinski 9y ago
One of the features of their stack is live single-click or even auto-update of you technology stack while your application keeps running. While that doesn't necessarily mean that you will keep your stack up-to-date, it makes patching security issues considerably easier and less painful, which means it's far less likely that you will be running a known-vulnerable version. So it's not entirely BS, even though why CoreOS helps security isn't spelled out here. I happen to have watched a talk where Alex Polvi did spell this out just last night, which is the only reason I know this. But yes, the rhetoric is a bit heavy-handed.
- oso2k 9y ago
  This is built-in functionality of Kubernetes (& OpenShift) called Rolling Update [0]/Rolling Deployments [1] and Image Triggers [2]. [0] https://kubernetes.io/docs/tasks/run-application/rolling-update-replication-controller/ https://kubernetes.io/docs/tasks/run-application/rolling-upd... [1] https://docs.openshift.com/container-platform/3.6/dev_guide/deployments/deployment_strategies.html#rolling-strategy https://docs.openshift.com/container-platform/3.6/dev_guide/... [2] https://docs.openshift.com/container-platform/3.6/dev_guide/builds/triggering_builds.html#image-change-triggers https://docs.openshift.com/container-platform/3.6/dev_guide/...

DCKing 9y ago

I like CoreOS, and I know this is some post that is meant for marketing purposes. But it's a shame they're propagating a myth that good security is the result of good tools. It's a common fallacy to think that these security problems have a technical solution first. They don't. CoreOS makes tools that helps security aware companies/organizations implement security, but being sufficiently security aware is the first step. Buying and using CoreOS products and support does not help you anything if you don't know how to use it well, or if your organization doesn't allow the engineers to use them effectively. It's become abundantly clear that mismanagement is the root cause of the Equifax hack, and that the vulnerable Struts server is just a symptom of it. A fool with a tool is still a fool. It's attractive to think CoreOS's products, or some other vendor's product, would have avoided this. But given the mismanagement it seems unlikely, and at best it would have just plugged a hole until another one popped up at some later time. Who knows that they already plugged some earlier worse holes with some other security products. Making the tools to make the internet more secure is the easy part. The hard part is getting everyone to use them in the right way. If tools and only buying things were the answer, the internet would have been a much more secure place already. So keep doing you CoreOS, keep making those tools. But please don't oversell yourself.

peatfreak 9y ago

"At CoreOS, our aim is to arm these companies with the tools to build their cloud services – and run our digital lives – correctly. We’re also dedicated to making it so easy to run these highly complex systems that they take care of themselves. What if they’ll never miss an update again. They’ll have all the security features turned on by default and new versions of applications will ship quickly and safely." What a load of absolute dreck this article is.

devonkim 9y ago

For everyone criticizing this because there's not much actual substance, I'm fairly certain this piece wasn't aimed at you - it was aimed at people that get taken by this kind of rhetoric over actual technology. If it comes down to the usual players in enterprise software or CoreOS / Tectonic, I'd be perfectly happy to see that stack as an option in the F500. I'm sure there's a lot of reservations we all have about the tone and content, but as long as the fundamental goal isn't just selling I can let it slide.

deleted 9y ago
[deleted]

flashdance 9y ago

> I believe in freedom. Founding fathers, Martin Luther King, Jr. – that kind of freedom. It’s the same kind of freedom that motivates my passion for free software. Oh boy, this CEO is laying it on pretty thick here... I'm a pretty steadfast advocate for free software--and I think open software does make a better society--but even then, I think it's a bit strange to use a comparison to MLK for something that seems an order of magnitude less important. It's giving me serious flashbacks to Silicon Valley. https://www.youtube.com/watch?v=J-GVd_HLlps https://www.youtube.com/watch?v=J-GVd_HLlps

kodablah 9y ago

Off-topic minor note to site owner: You have two shortcut icon references in your head, and one of them references the relative ico/favicon.png which 404's. Chrome falls back but many others do not and you get no favicon.

bashcoder 9y ago

It was my understanding that CoreOS was started as a minimal Linux distro tooled for hosting and orchestrating Docker containers. IMHO, Docker still has a long way to go to impress the security community.

mankash666 9y ago

Why do people lie about founding stories. Most of them boil down to two things: 1> We like making money 2> We enjoy working in the domain the company operates in. Everything else is a usually made up crap for branding, PR and to feed tech journalists.

stevefan1999 9y ago

As far as I know, if a malicious user compromised the CoreOS update central and pushed a new rolling update, then everyone using CoreOS and (presumably automatically) received the rolling update will also be hacked, the end. This is an even bigger evil. It's no difference to a botnet . I don't know if CoreOS has some kind of update signing/verification or what but based on my assertion I wouldn't suggest using it.