4 ms·

Enterprises want to consume software dependencies they can trust. In a peer-to-peer model, anybody can publish anything. The value in having some sort of interm

Enterprises want to consume software dependencies they can trust. In a peer-to-peer model, anybody can publish anything. The value in having some sort of intermediary (e.g., Artifactory, etc) is they can act as a gateway before vulnerable dependencies make it into your build pipeline.

ses1984 8y ago
But torrent has built in integrity checking. You should still check signatures on packages. Your distribution and storage media should be totally independent of the packages you choose to use and how you validate them.
- JMTQp8lwXL 8y ago
  I think the idea is that enterprises would still prefer to offload that responsibility to a third-party provider. I agree with what you're saying, from a risk management perspective, you shouldn't be trusting that your dev's will be pulling in safe third party code (e.g., from the NPM public registry) instead of forcing them to go through your dependency gateway (e.g., artifactory). Under the hood, a tool like Artifactory could take advantage of this means of distribution, be responsible for signature checking, etc.
  - baroffoos 8y ago
    I didn't think anyone was suggesting to pull random stuff out of a p2p network but instead that you build your docker image and then use p2p to share it to thousands of servers. There are no trust issues here because you are the creator of the data being downloaded.
tlrobinson 8y ago
> In a peer-to-peer model, anybody can publish anything. That doesn't have to be the case. You can certainly have private peer-to-peer networks that are authenticated and/or restricted to your internal network. Facebook did this back in 2010: https://torrentfreak.com/facebook-uses-bittorrent-and-they-love-it-100625/ https://torrentfreak.com/facebook-uses-bittorrent-and-they-l...
- puzzle 8y ago
  Google did it even before that and it's closer to a P2P model than Kraken (all Borg nodes participate, IIRC). By 2010, quite a few services built on top of Borg/MPM with the feature enabled had already undergone SAS 70 (later SOC / SSAE) audits. I know because one of my teams had to work on compliance. So there's nothing about this that is intrinsically not fit for the enterprise or to meet regulations. You have to do the legwork to meet the auditors' requests, of course.

ses1984 8y ago

But torrent has built in integrity checking. You should still check signatures on packages. Your distribution and storage media should be totally independent of the packages you choose to use and how you validate them.

JMTQp8lwXL 8y ago
I think the idea is that enterprises would still prefer to offload that responsibility to a third-party provider. I agree with what you're saying, from a risk management perspective, you shouldn't be trusting that your dev's will be pulling in safe third party code (e.g., from the NPM public registry) instead of forcing them to go through your dependency gateway (e.g., artifactory). Under the hood, a tool like Artifactory could take advantage of this means of distribution, be responsible for signature checking, etc.
- baroffoos 8y ago
  I didn't think anyone was suggesting to pull random stuff out of a p2p network but instead that you build your docker image and then use p2p to share it to thousands of servers. There are no trust issues here because you are the creator of the data being downloaded.

tlrobinson 8y ago

> In a peer-to-peer model, anybody can publish anything. That doesn't have to be the case. You can certainly have private peer-to-peer networks that are authenticated and/or restricted to your internal network. Facebook did this back in 2010: https://torrentfreak.com/facebook-uses-bittorrent-and-they-love-it-100625/ https://torrentfreak.com/facebook-uses-bittorrent-and-they-l...

puzzle 8y ago
Google did it even before that and it's closer to a P2P model than Kraken (all Borg nodes participate, IIRC). By 2010, quite a few services built on top of Borg/MPM with the feature enabled had already undergone SAS 70 (later SOC / SSAE) audits. I know because one of my teams had to work on compliance. So there's nothing about this that is intrinsically not fit for the enterprise or to meet regulations. You have to do the legwork to meet the auditors' requests, of course.