5 ms·

While this is intuitive and obvious those who have used debian (or rather apt) for decades, it seems that a whole generation of computer professionals don't gra

While this is intuitive and obvious those who have used debian (or rather apt) for decades, it seems that a whole generation of computer professionals don't grasp it. Modern software development involves pulling tons of libraries (often at runtime) from other locations. A lot of damage was done by things like 'sudo pip install xxx' and 'curl http://blah.com/install.sh|sudo http://blah.com/install.sh|sudo bash' At least docker's install uses https before downloading some random text from the internet, nowhere near as secure as gpg signing a package though -- compromise the website and you win.

eeZah7Ux 8y ago
> At least docker's install uses https Anybody with a fake email address can upload a bunch of backdoored images on dockerhub and there's no way to spot that.
- isostatic 8y ago
  Presumably a given repository is secure? At least as much as a https certificate makes it secure (which means a compromise of a docker certificate or website means a compromise of everything on it) This isn't about downloading random crap from the internet, it's about having the communication between who you trust (redhat, microsoft, dave smith) being secure. GPG signing of the code you download means that you are running the code from the person with that GPG key. Doesn't matter if the server the reporistory is on is compromised via a DNS/https hack, or via some other means. The worst that will happen is you download the compromised software, it doesn't match the person/organization you trust, and you delete it.
- kpcyrd 8y ago
  They get their own namespace, they can't overwrite random existing images.