4 ms·

>That's akin to installing randomly downloaded software from warezRus.com All right, then say that. Say that you view Docker Hub like warezRus.com or a site t

>That's akin to installing randomly downloaded software from warezRus.com All right, then say that. Say that you view Docker Hub like warezRus.com or a site that opens in Chrome like this https://www.google.com/search?q=chrome+red+warning&tbm=isch https://www.google.com/search?q=chrome+red+warning&tbm=isch Don't say that "unless the image was created by a trusted party (a party that you trust, not that someone else trusts) then there is no reason to assume that it friendly." That is going too far. It's a continuum, but the "Okay, I'll run it" end of the continuum shouldn't be something you "trust". It should be something you're willing to run. Like everyone else, I'm typing this on a device that I shouldn't "trust". You should replace your idea of parties you should "trust" with parties you are willing to run something from. If Docker Images isn't one such party, then say that.

jacquesm 8y ago
You are conflating 'Docker Images' as one party and Joe Random user who uploads his image to 'Docker Images'. They are not the same entity at all. Assuming Docker Images has reasonable security and that someone who I trust would upload a (signed by them) docker image to Docker Images then you could download that image and use it if you trust the uploader and their signature.
- logicallee 8y ago
  you're saying something useful, but I just think the word "trust" at the end is too strong. How about instead of: * you could download that image and use it if you trust the uploader and their signature. (your phrasing), what if instead you wrote: * you could download that image and use it if the developer seems technically competent and benevolent, or seems like they wouldn't be playing shenanigans, and you're sure that the developer is who they it is (their reputations aren't being coopted by someone else with a similar or fake name). (perhaps what you mean). or: * you could download that image and use it if it is put up by some huge development team with a big brand to protect. (if that's what you mean). Basically there must be some more precise way to say what you mean. I just don't think you're expressing the concept very precisely.

jacquesm 8y ago

You are conflating 'Docker Images' as one party and Joe Random user who uploads his image to 'Docker Images'. They are not the same entity at all. Assuming Docker Images has reasonable security and that someone who I trust would upload a (signed by them) docker image to Docker Images then you could download that image and use it if you trust the uploader and their signature.

logicallee 8y ago
you're saying something useful, but I just think the word "trust" at the end is too strong. How about instead of: * you could download that image and use it if you trust the uploader and their signature. (your phrasing), what if instead you wrote: * you could download that image and use it if the developer seems technically competent and benevolent, or seems like they wouldn't be playing shenanigans, and you're sure that the developer is who they it is (their reputations aren't being coopted by someone else with a similar or fake name). (perhaps what you mean). or: * you could download that image and use it if it is put up by some huge development team with a big brand to protect. (if that's what you mean). Basically there must be some more precise way to say what you mean. I just don't think you're expressing the concept very precisely.