3 ms·

This is definitely a rant that obscures the underlying point: the introduction of _untrusted_ or _unreliable_ network resources, frequently hidden in a string o

This is definitely a rant that obscures the underlying point: the introduction of _untrusted_ or _unreliable_ network resources, frequently hidden in a string of dependencies. I'm baffled how often I see an someone throw this sort of craziness - "go fetch this thing from some random third party" - into very important places, such as the startup procedures of a container. It's something I see in a culture of the two person startup just trying to get something out the door. It's definitely "technical debt", and frequently, it won't get removed. Thus, you try to scale up to meet load, and all these new instances go time out on the same external resource that's randomly having problems... boom! At the worst possible time. Never mind the potential huge security gaps. But the specific _tools_ aren't the issue here. It's the culture of "ship something now we'll deal with fallout later". A lot of people start using Docker and won't ever look at the Dockerfile, or, will add a Maven dependency and won't even check licenses or security updates for _any_ of the transient dependencies. Cloud technologies and containerization make everyone just think "we can do things so fast now" and never, ever pay attention to details that can come back to bite you. On the flip side, it's a good time to be in cybersecurity; because this cultural problem will never, ever, get solved. :)

alfalfasprout 8y ago
You know, I used to agree with you. But the reality is you have to weigh the massive productivity boosts that things like docker bring to the table vs. the potential issues it can bring. To a large degree, good perimeter security mitigates a lot of the concerns of containers themselves running slightly out of date software.
- kazen44 8y ago
  > To a large degree, good perimeter security mitigates a lot of the concerns of containers themselves running slightly out of date software. this is a very naive way of setting up a secure production enviroment. Your perimeter security is worthless if you are loading non public images which have malware or even worse, unknown malicious code in them. having a data breach or hack on your hands is something which could kill the company. That risk is not worth having a slightly faster productivity boost because you or your ops team is not able or willing to build a proper private repository setup.
borplk 8y ago
At the end of the day it comes down to the fact that businesses just simply don't care (Equifax etc). They like the idea of security and that's where it ends. In many places if you try to "do things right" you will get fired in two months for being too slow/strict and they will happily replace you with a clueless easily trusting person who "goes and fetches things from random third parties". Many times they get lucky enough to survive and they don't appreciate the risks that they took. That pace becomes the expected norm and sets the theme in the industry. And when shit hits the fan the PR person writes a "we are oh so very sorry .. security is totally our number one priority" blog post. They blame and fire the poor bastard and replace him with another warm body. When it comes to these "hidden" things like security companies do not reward and also punish "doing things right" so on average and over the long term we end up where we are today. When the culture sufficiently shifts towards being sloppy you will get hammered down quick if you try to be the voice of reason because it ends up being you vs everyone else (the norm).
- commandlinefan 8y ago
  > just simply don't care (Equifax etc). And, honestly, why should they? Security breaches have yet to hurt an actual company (they hurt users plenty, but not the organization that's actually responsible).
  - mr_tristan 8y ago
    Data breaches are climbing in cost to organizations. Here's a claim, that in 2017, the average breach costs $3.62 million. https://www.scrypt.com/blog/average-cost-data-breach-2017-3-62-million/ https://www.scrypt.com/blog/average-cost-data-breach-2017-3-... (I've seen similar claims in different ranges. Costs of breaches in the US are pretty high - over $7 million.) Even Equifax probably wants the 3-4 billion in valuation it's lost since the breach. The solution appears to be buying tools to avoid and respond to breaches quickly, instead of engaging and building in security awareness. (Microsoft's security development lifecycle comes to mind.) IMO, both approaches are likely cost effective, though I have no numbers or research to back that up.
dvfjsdhgfv 8y ago
Yes, it's definitely not something related only to Docker, it's today's culture of trusting all possible code only because someone placed it on Github.
- AlexCoventry 8y ago
  There's so much leverage in that code, though. It's clear how the culture evolved.

alfalfasprout 8y ago

You know, I used to agree with you. But the reality is you have to weigh the massive productivity boosts that things like docker bring to the table vs. the potential issues it can bring. To a large degree, good perimeter security mitigates a lot of the concerns of containers themselves running slightly out of date software.

kazen44 8y ago
> To a large degree, good perimeter security mitigates a lot of the concerns of containers themselves running slightly out of date software. this is a very naive way of setting up a secure production enviroment. Your perimeter security is worthless if you are loading non public images which have malware or even worse, unknown malicious code in them. having a data breach or hack on your hands is something which could kill the company. That risk is not worth having a slightly faster productivity boost because you or your ops team is not able or willing to build a proper private repository setup.

borplk 8y ago

At the end of the day it comes down to the fact that businesses just simply don't care (Equifax etc). They like the idea of security and that's where it ends. In many places if you try to "do things right" you will get fired in two months for being too slow/strict and they will happily replace you with a clueless easily trusting person who "goes and fetches things from random third parties". Many times they get lucky enough to survive and they don't appreciate the risks that they took. That pace becomes the expected norm and sets the theme in the industry. And when shit hits the fan the PR person writes a "we are oh so very sorry .. security is totally our number one priority" blog post. They blame and fire the poor bastard and replace him with another warm body. When it comes to these "hidden" things like security companies do not reward and also punish "doing things right" so on average and over the long term we end up where we are today. When the culture sufficiently shifts towards being sloppy you will get hammered down quick if you try to be the voice of reason because it ends up being you vs everyone else (the norm).

commandlinefan 8y ago
> just simply don't care (Equifax etc). And, honestly, why should they? Security breaches have yet to hurt an actual company (they hurt users plenty, but not the organization that's actually responsible).
- mr_tristan 8y ago
  Data breaches are climbing in cost to organizations. Here's a claim, that in 2017, the average breach costs $3.62 million. https://www.scrypt.com/blog/average-cost-data-breach-2017-3-62-million/ https://www.scrypt.com/blog/average-cost-data-breach-2017-3-... (I've seen similar claims in different ranges. Costs of breaches in the US are pretty high - over $7 million.) Even Equifax probably wants the 3-4 billion in valuation it's lost since the breach. The solution appears to be buying tools to avoid and respond to breaches quickly, instead of engaging and building in security awareness. (Microsoft's security development lifecycle comes to mind.) IMO, both approaches are likely cost effective, though I have no numbers or research to back that up.

dvfjsdhgfv 8y ago

Yes, it's definitely not something related only to Docker, it's today's culture of trusting all possible code only because someone placed it on Github.

AlexCoventry 8y ago
There's so much leverage in that code, though. It's clear how the culture evolved.