5 ms·
Sounds like a dream to compromise! Rather than one attack surface, there's like 25. Crack one and you take the lot.
by Narkov 6y ago
Sounds like a dream to compromise! Rather than one attack surface, there's like 25. Crack one and you take the lot.
- toyg 6y agoIt's a home server, not an enterprise network. Security is a trade-off.
- Narkov 6y agoI would assume the administrator cares enough about their own data to want to do it properly.
- dsr_ 6y agoIt provides 25 services. If I were going to deploy 25 machines to provide 25 services, that would not reduce the attack surface... of my house server.
- Narkov 6y agoWith no segregation, you crack one service you get access to all 25 services and their data. With segregation, you crack one service you get access to just that container/physical service.
- kortilla 6y agoLinux has had support for multiple users for quite some time now. Popping a standard service process doesn’t get you any more than the privileges of the running user, which is usually scoped to that service alone. Install Ubuntu, Postgres+apache2, then su to www-data and try read some data from the postgres data directory to see what I mean.
- ex_amazon_sde 6y agoPlus the additional huge attack surface of docker, docker hub and k8s