> I'm a little appalled at the general attitude here. "These issues are probably nothing," is just not a good approach to security. "My app only exposes port 80

> I'm a little appalled at the general attitude here. "These issues are probably nothing," is just not a good approach to security. "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security. "Docker images always have a bunch of junk installed that you don't actually use," is not a good approach to security. We aren't saying that it was the good approach to security, we are just saying that fear-mongering articles like that aren't the good approach to security. That remind me of the anti-virus software that listed each cookies as a virus. If to exploit a security vulnerability in a software you need a security vulnerability that give the same right as that software that contains the vulnerability... yeah you don't have to care about this. I would be happy to be shown wrong on that statement. Does that apply to all the vulnerabilities they count? Probably not, but it certainly inflate the number, just like cookies in an anti-virus count, both give a wrong idea of what's actually happening and aren't the solution to a safer world. Am I crazy to think that we don't have to lie to give security suggestion? > If people out in the world can't install your software because it's not compatible with a library they have updated to patch a security vulnerability, they you will hear about it, and maybe get a patch. If people just install your docker image... eh, it works, why bother looking behind the curtain and see how? That's your definition of a good approach to security?