3 ms·
Both are correct. I've been a sysadmin fixing vulns in PCI infra identified by a Major Security Vendor, cussing about how pointless it is to fix most of them, a
by rconti 8y ago
Both are correct. I've been a sysadmin fixing vulns in PCI infra identified by a Major Security Vendor, cussing about how pointless it is to fix most of them, all in order to change some magic number to get below the acceptable threshold. I've worked for that Major Security Vendor. And now I'm working elsewhere, using Docker images from god knows where. It truly is quite stunning how cavalier people can be about their container deployments, but the reality is the vast majority of these vulns have never mattered to the vast majority of people. But it's also important to be on top of what the vulns are, so you can assess if they matter to you or not.
We started in a place of way too little concern about security vulnerabilities. Some environments are still there, but many have been driven by draconian policy to go way overboard.
- zebraflask 8y agoI think that's an insightful assessment.
- haroldp 8y agoOof, I have been there on dumb PCI "fixes"! But my big concern here is, "How do Docker users stay on top of vulnerabilities?" And I worry that for many of them, the answer is that they don't. Or they just update their image when a new version comes out. And the latter answer could actually be a big win for security... provided Docker image maintainers are staying on top of vulnerabilities. Is the Docker infrastructure doing a good job of policing that? Of highlighting images that have known vulnerabilities? Lots of people are replying that the article doesn't give any details about which vulnerabilities. That's valid, but is Docker giving details about known vulnerabilities?
- rconti 8y agoI think this is what people are banking on with CI/CD. In theory if the maintainers knew what they were doing, we could just roll new containers same day. Because patching things in-place has ALWAYS been a nightmare.