4 ms·
Infosec in 2019: The server I download code from telling me the hash of said code is "certainly an excellent hardening step".
by blattimwind 8y ago
Infosec in 2019: The server I download code from telling me the hash of said code is "certainly an excellent hardening step".
- ithkuil 8y agoCan't the hash be verified by the client too?
- subway 8y agoSure, but who tells the client what the correct hash is?
- krferriter 8y agoIf you're the entity who created the image you can retain the original hash and verify it against the downloaded copies. But that kind of defeats the purpose of being able to download docker images across distributed hosts. They'd really need to be signatures attached to the images, not just hashes.
- gtsteve 8y agoWell I was approaching it from the point of view that you verify the image is correct and then you guarantee you'll always use that image and not some other version given that tags are mutable.