6 ms·

I'm a little appalled at the general attitude here. "These issues are probably nothing," is just not a good approach to security. "My app only exposes port 80

I'm a little appalled at the general attitude here. "These issues are probably nothing," is just not a good approach to security. "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security. "Docker images always have a bunch of junk installed that you don't actually use," is not a good approach to security. Am I crazy? What does this tell us about Docker as an ecosystem? It's amazing tech, to be sure, but I feel like a lot of projects are leaning on, "just install the docker image," to avoid the hassles of making flexible, compatible, installable, readable software. If people out in the world can't install your software because it's not compatible with a library they have updated to patch a security vulnerability, they you will hear about it, and maybe get a patch. If people just install your docker image... eh, it works, why bother looking behind the curtain and see how? That's a ecosystem where I would expect to see a lot of bloat and security vulnerabilities creeping in and getting worse over time.

dentemple 8y ago
The general attitude is not that the issues are "probably nothing". The general attitude is that, if you're not saying what the issues actually are, then counting them doesn't tell you anything meaningful.
dwild 8y ago
> I'm a little appalled at the general attitude here. "These issues are probably nothing," is just not a good approach to security. "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security. "Docker images always have a bunch of junk installed that you don't actually use," is not a good approach to security. We aren't saying that it was the good approach to security, we are just saying that fear-mongering articles like that aren't the good approach to security. That remind me of the anti-virus software that listed each cookies as a virus. If to exploit a security vulnerability in a software you need a security vulnerability that give the same right as that software that contains the vulnerability... yeah you don't have to care about this. I would be happy to be shown wrong on that statement. Does that apply to all the vulnerabilities they count? Probably not, but it certainly inflate the number, just like cookies in an anti-virus count, both give a wrong idea of what's actually happening and aren't the solution to a safer world. Am I crazy to think that we don't have to lie to give security suggestion? > If people out in the world can't install your software because it's not compatible with a library they have updated to patch a security vulnerability, they you will hear about it, and maybe get a patch. If people just install your docker image... eh, it works, why bother looking behind the curtain and see how? That's your definition of a good approach to security?
- haroldp 8y ago
  > That's your definition of a good approach to security? Are you asking if many people looking at your software is likely to improve it's security?
rconti 8y ago
Both are correct. I've been a sysadmin fixing vulns in PCI infra identified by a Major Security Vendor, cussing about how pointless it is to fix most of them, all in order to change some magic number to get below the acceptable threshold. I've worked for that Major Security Vendor. And now I'm working elsewhere, using Docker images from god knows where. It truly is quite stunning how cavalier people can be about their container deployments, but the reality is the vast majority of these vulns have never mattered to the vast majority of people. But it's also important to be on top of what the vulns are, so you can assess if they matter to you or not. We started in a place of way too little concern about security vulnerabilities. Some environments are still there, but many have been driven by draconian policy to go way overboard.
- zebraflask 8y ago
  I think that's an insightful assessment.
- haroldp 8y ago
  Oof, I have been there on dumb PCI "fixes"! But my big concern here is, "How do Docker users stay on top of vulnerabilities?" And I worry that for many of them, the answer is that they don't. Or they just update their image when a new version comes out. And the latter answer could actually be a big win for security... provided Docker image maintainers are staying on top of vulnerabilities. Is the Docker infrastructure doing a good job of policing that? Of highlighting images that have known vulnerabilities? Lots of people are replying that the article doesn't give any details about which vulnerabilities. That's valid, but is Docker giving details about known vulnerabilities?
  - rconti 8y ago
    I think this is what people are banking on with CI/CD. In theory if the maintainers knew what they were doing, we could just roll new containers same day. Because patching things in-place has ALWAYS been a nightmare.
eeZah7Ux 8y ago
> Am I crazy? No. By throwing away dependency management since the beginning, security was thrown under the bus straight away. Meanwhile some Linux distributions are still doing careful packaging, freezing, vendorization of dependencies, backporting security fixes to stable releases and so on.
- zapita 8y ago
  So if we were to scan those Linux distributions for the same vulnerabilities found in the Docker images under discussion, we would find no vulnerabilities whatsoever?
  - yjftsjthsd-h 8y ago
    Do we have to hit "no vulnerabilities whatsoever", or can we settle for "a lot less" and leave the goalposts alone?
    - zapita 8y ago
      Fair enough. So what’s your answer?
      - eeZah7Ux 8y ago
        A lot less, mostly because: - the docker containers are often based on the same distributions - the distribution keeps received security updates that are often neglected by the docker ecosystem - the distribution is designed to give maximum control to system engineers: not to install (or remove) any package that is not required - applications are packaged using dynamic linking and without vendored dependencies as much as possible. Vulnerabilities in dependencies are patched once and for all system-wide - some distributions do peer review and have a very high entry bar to become a member
balls187 8y ago
> "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security...Am I crazy Well no, but they're not off-base either. Security is best implemented through a layered approach. Security is also an exercise in risk analysis and mitigation.
- haroldp 8y ago
  > Security is best implemented through a layered approach. Such an important point.
bayesian_horse 8y ago
Improving security is a classic 80/20 situation. Unless your job is nothing but security, you better focus on the impact first. This article is scaremongering with the intent to market a product. The scaremongering itself is really not helpful to the education of the non-security or non-technical people.

dentemple 8y ago

The general attitude is not that the issues are "probably nothing". The general attitude is that, if you're not saying what the issues actually are, then counting them doesn't tell you anything meaningful.

dwild 8y ago

> I'm a little appalled at the general attitude here. "These issues are probably nothing," is just not a good approach to security. "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security. "Docker images always have a bunch of junk installed that you don't actually use," is not a good approach to security. We aren't saying that it was the good approach to security, we are just saying that fear-mongering articles like that aren't the good approach to security. That remind me of the anti-virus software that listed each cookies as a virus. If to exploit a security vulnerability in a software you need a security vulnerability that give the same right as that software that contains the vulnerability... yeah you don't have to care about this. I would be happy to be shown wrong on that statement. Does that apply to all the vulnerabilities they count? Probably not, but it certainly inflate the number, just like cookies in an anti-virus count, both give a wrong idea of what's actually happening and aren't the solution to a safer world. Am I crazy to think that we don't have to lie to give security suggestion? > If people out in the world can't install your software because it's not compatible with a library they have updated to patch a security vulnerability, they you will hear about it, and maybe get a patch. If people just install your docker image... eh, it works, why bother looking behind the curtain and see how? That's your definition of a good approach to security?

haroldp 8y ago
> That's your definition of a good approach to security? Are you asking if many people looking at your software is likely to improve it's security?

rconti 8y ago

Both are correct. I've been a sysadmin fixing vulns in PCI infra identified by a Major Security Vendor, cussing about how pointless it is to fix most of them, all in order to change some magic number to get below the acceptable threshold. I've worked for that Major Security Vendor. And now I'm working elsewhere, using Docker images from god knows where. It truly is quite stunning how cavalier people can be about their container deployments, but the reality is the vast majority of these vulns have never mattered to the vast majority of people. But it's also important to be on top of what the vulns are, so you can assess if they matter to you or not. We started in a place of way too little concern about security vulnerabilities. Some environments are still there, but many have been driven by draconian policy to go way overboard.

zebraflask 8y ago
I think that's an insightful assessment.
haroldp 8y ago
Oof, I have been there on dumb PCI "fixes"! But my big concern here is, "How do Docker users stay on top of vulnerabilities?" And I worry that for many of them, the answer is that they don't. Or they just update their image when a new version comes out. And the latter answer could actually be a big win for security... provided Docker image maintainers are staying on top of vulnerabilities. Is the Docker infrastructure doing a good job of policing that? Of highlighting images that have known vulnerabilities? Lots of people are replying that the article doesn't give any details about which vulnerabilities. That's valid, but is Docker giving details about known vulnerabilities?
- rconti 8y ago
  I think this is what people are banking on with CI/CD. In theory if the maintainers knew what they were doing, we could just roll new containers same day. Because patching things in-place has ALWAYS been a nightmare.

eeZah7Ux 8y ago

> Am I crazy? No. By throwing away dependency management since the beginning, security was thrown under the bus straight away. Meanwhile some Linux distributions are still doing careful packaging, freezing, vendorization of dependencies, backporting security fixes to stable releases and so on.

zapita 8y ago
So if we were to scan those Linux distributions for the same vulnerabilities found in the Docker images under discussion, we would find no vulnerabilities whatsoever?
- yjftsjthsd-h 8y ago
  Do we have to hit "no vulnerabilities whatsoever", or can we settle for "a lot less" and leave the goalposts alone?
  - zapita 8y ago
    Fair enough. So what’s your answer?
    - eeZah7Ux 8y ago
      A lot less, mostly because: - the docker containers are often based on the same distributions - the distribution keeps received security updates that are often neglected by the docker ecosystem - the distribution is designed to give maximum control to system engineers: not to install (or remove) any package that is not required - applications are packaged using dynamic linking and without vendored dependencies as much as possible. Vulnerabilities in dependencies are patched once and for all system-wide - some distributions do peer review and have a very high entry bar to become a member

balls187 8y ago

> "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security...Am I crazy Well no, but they're not off-base either. Security is best implemented through a layered approach. Security is also an exercise in risk analysis and mitigation.

haroldp 8y ago
> Security is best implemented through a layered approach. Such an important point.

bayesian_horse 8y ago

Improving security is a classic 80/20 situation. Unless your job is nothing but security, you better focus on the impact first. This article is scaremongering with the intent to market a product. The scaremongering itself is really not helpful to the education of the non-security or non-technical people.