4 ms·

Yum update, pip install whatever :)

• nineteen999 8y ago
  Rubygems for everybody! Or arbitrary docker containers. My current deployments allow outbound SMTP only. All software packages (rpm or whatever) get pushed in via rsync from the outside, or are built in an adjacent lab behind the firewalls and pushed across.
  • auslander 8y ago
    It may affect the very source box you are using for package downloads. I bet it is allowed to go outside unrestricted. Funny you mentioned Docker, it is a security nightmare in itself.
    • nineteen999 8y ago
      Indeed, although it is connected via rather restrictive corporate proxy. I'd rather have one box on my network exposed where I can monitor it than a thousand instances with unrestricted outbound access in AWS though. Oh yeah - docker. I thought this one was pretty funny: https://threatpost.com/malicious-docker-containers-earn-crypto-miners-90000/132816/ https://threatpost.com/malicious-docker-containers-earn-cryp...
  • Kalium 8y ago
    It's sometimes surprising who gets unhappy when you tell them they can't just run arbitrary code from places unknown in prod.