3 ms·

“But each layer here adds an element of required trust”, how often we simply glance over that and assume. In the same time, building everything from source is a

“But each layer here adds an element of required trust”, how often we simply glance over that and assume. In the same time, building everything from source is also neither reasonable nor 100% secure. Glad smart people like Dan are looking into this.

jeffbee 6y ago
What's not reasonable about building from source? It really seems like a small cost to snapshot a version of third-party code into your own source control system. There really aren't (or shouldn't be) that many different things in your environment.
- mchmarny 6y ago
  The amount of dependancies, build environment setup steps, across all of the components, and sheer complexity of putting the entire stack together from scratch, would exclude a substantial portion of the target users... hence, while possible, is not reasonable, certainly not on angling basis.
- knowhy 6y ago
  Building from source seems me the only way to get to a reasonable state when it comes to security patching. However these modern stacks contain a lot of small parts. The article gives the kiwigrid/k8s-sidecar as an example. Also, well shown in the article, it is not as easy as copying some commands to your own Dockerfile. Look at the busybox image using glibc from another debian image. It's not reasonable in the sense that it is a hell lot of work and would require more time and effort the average devops/sre/whatever (team) has. It would also go against the promise that Kubernetes would make things easy because you could just do helm install stable/prometheus
- jacques_chester 6y ago
  I worked on buildpacks for a while. Those had to track "only" a few hundred upstream dependencies and build them from source. It took a fulltime team to build and maintain the infrastructure. The problem here is economic. Because there is no body of information about software assets acting as public good, each individual is forced to internalise the costs. Either you internalise the cost of building everything yourself, or you internalise the risk of accepting incoming assets on faith. But you bear a cost.

jeffbee 6y ago

What's not reasonable about building from source? It really seems like a small cost to snapshot a version of third-party code into your own source control system. There really aren't (or shouldn't be) that many different things in your environment.

mchmarny 6y ago
The amount of dependancies, build environment setup steps, across all of the components, and sheer complexity of putting the entire stack together from scratch, would exclude a substantial portion of the target users... hence, while possible, is not reasonable, certainly not on angling basis.
knowhy 6y ago
Building from source seems me the only way to get to a reasonable state when it comes to security patching. However these modern stacks contain a lot of small parts. The article gives the kiwigrid/k8s-sidecar as an example. Also, well shown in the article, it is not as easy as copying some commands to your own Dockerfile. Look at the busybox image using glibc from another debian image. It's not reasonable in the sense that it is a hell lot of work and would require more time and effort the average devops/sre/whatever (team) has. It would also go against the promise that Kubernetes would make things easy because you could just do helm install stable/prometheus
jacques_chester 6y ago
I worked on buildpacks for a while. Those had to track "only" a few hundred upstream dependencies and build them from source. It took a fulltime team to build and maintain the infrastructure. The problem here is economic. Because there is no body of information about software assets acting as public good, each individual is forced to internalise the costs. Either you internalise the cost of building everything yourself, or you internalise the risk of accepting incoming assets on faith. But you bear a cost.