5 ms·

and don't forget that crap code == insecure code. but nobody have to worry about it. just start a container the last guy left. /sarcasm

• geofft 9y ago
  > and don't forget that crap code == insecure code. I don't think I believe that equality is nearly as neat you'd hope. Unless we're willing to call all code crap code, a lot of projects with well-respected code and development practices have had serious zero days, and we've also found that sandboxing software is highly effective. Insecure code in a secure, well-written sandbox can get you a secure deployment, and you probably want to have your "good" code in a well-written sandbox anyway.
  • gcb0 9y ago
    zero days and the privilege escalation are a luxury. bad code is often plaged with injection/sql injection. Which sandbox does an absolute NOTHING to protect you from. After all, it is all within the expected side effects of your code.
    • bm1362 9y ago
      What does this have to do with Docker then?
      • gcb0 9y ago
        because a flawed argument in defense of containers is that it is safer, since it's harder to escalate priviledges. my point is that false sense of security makes it even easier for an attacker to use readily available privileges in the badly coded application.