6 ms·

One of the purported benefits is security, however from my experience in the financial software industry, I have to say - good luck getting your software valida

by samhuk 6y ago

One of the purported benefits is security, however from my experience in the financial software industry, I have to say - good luck getting your software validated where a major part of it's build chain is from an external "community". politelemon here is spot-on in this regard: dockerfiles provide a higher level of transparency. Although they do have a higher developer-error surface area compared to more higher-level build chain solutions, it is absolutely necessary for many software industries that require stricter software validation.

ojhughes 6y ago
I see your point but there is nothing to stop organisations maintaining their own set of "trusted builders". `FROM node` etc is still relying on external communities, the buck has to stop somewhere
- kkapelon 6y ago
  You can actually do from a private Docker image that YOU have created and going upwards you only hit from "scratch" so in that case there are no external communities involved. I am not saying that people should do this in practice, but it is certainly possible.
- samhuk 6y ago
  I certainly agree with you there, but I was going off the article, which gave off a strong viewpoint of "Oh, you don't actually make these builders though, are you nuts?" Any kind of technology like this tends to stick out when pitching software to financial industries, who like technologies that don't have many levels of abstraction (which to them, minimizes where they get to place accountability and the surface area for issues). Regardless, you have a point and what you say is true. But "truth" and "financially compliant", are not terms to be mixed.
jacques_chester 6y ago
> One of the purported benefits is security, however from my experience in the financial software industry, I have to say - good luck getting your software validated where a major part of it's build chain is from an external "community". Paketo buildpacks are the latest generation in a series of buildpack technogies that have made Pivotal (now VMware) hundreds and hundreds of millions of dollars from the finance industry. Heroku/Salesforce could have made much more. Google will almost certainly make as much. Finance security and compliance folks love buildpacks. Love. If they loved them any more they would get tattoos and name their kids See Enbee. Disclosure: I work for VMware, via the Pivotal acquisition. I've worked on buildpacks several times.
- xyzthrowaway112 6y ago
  Not mentioned in all this buildpack hype is the fact that Pivotal was acquired by VMWare precisely because Pivotal's share price saw a single day drop of 41% in addition to a shareholder class action lawsuit. >The class accredits Pivotal’s diminished growth to customers who shifted away from what they call “Pivotal’s principle, yet outdated and inadequate offering because it was incompatible with the industry-standard platform.” https://www.courthousenews.com/post-ipo-woes-mount-for-pivotal-software-after-train-wreck-first-quarter-in-2019/ https://www.courthousenews.com/post-ipo-woes-mount-for-pivot...
  - deleted 6y ago
    [deleted]
- samhuk 6y ago
  throwaway may have a good point. Also, kudos on joining VMware. I'm not doubting your experience here, but financial security firms vary hugely on their opinions and eventual implementation of compliance. In my experience, dealing with a business like Monzo and dealing with the back-office department of JPMorgan (these are not exact to me for security reasons), are worlds apart. There are financial firms I've dealt with which will simply not sign off on something like the highest-of-high level build chain tools.
  - jacques_chester 6y ago
    > I'm not doubting your experience here, but financial security firms vary hugely on their opinions and eventual implementation of compliance. I agree! That was my point: finance folks are not universally in favour of X or Y. Within any firm there is vast heterogeneity. Just as some will never accept buildpacks, some will never accept anything less.

by samhuk 6y ago

ojhughes 6y ago

I see your point but there is nothing to stop organisations maintaining their own set of "trusted builders". `FROM node` etc is still relying on external communities, the buck has to stop somewhere

kkapelon 6y ago
You can actually do from a private Docker image that YOU have created and going upwards you only hit from "scratch" so in that case there are no external communities involved. I am not saying that people should do this in practice, but it is certainly possible.
samhuk 6y ago
I certainly agree with you there, but I was going off the article, which gave off a strong viewpoint of "Oh, you don't actually make these builders though, are you nuts?" Any kind of technology like this tends to stick out when pitching software to financial industries, who like technologies that don't have many levels of abstraction (which to them, minimizes where they get to place accountability and the surface area for issues). Regardless, you have a point and what you say is true. But "truth" and "financially compliant", are not terms to be mixed.

jacques_chester 6y ago

> One of the purported benefits is security, however from my experience in the financial software industry, I have to say - good luck getting your software validated where a major part of it's build chain is from an external "community". Paketo buildpacks are the latest generation in a series of buildpack technogies that have made Pivotal (now VMware) hundreds and hundreds of millions of dollars from the finance industry. Heroku/Salesforce could have made much more. Google will almost certainly make as much. Finance security and compliance folks love buildpacks. Love. If they loved them any more they would get tattoos and name their kids See Enbee. Disclosure: I work for VMware, via the Pivotal acquisition. I've worked on buildpacks several times.

xyzthrowaway112 6y ago
Not mentioned in all this buildpack hype is the fact that Pivotal was acquired by VMWare precisely because Pivotal's share price saw a single day drop of 41% in addition to a shareholder class action lawsuit. >The class accredits Pivotal’s diminished growth to customers who shifted away from what they call “Pivotal’s principle, yet outdated and inadequate offering because it was incompatible with the industry-standard platform.” https://www.courthousenews.com/post-ipo-woes-mount-for-pivotal-software-after-train-wreck-first-quarter-in-2019/ https://www.courthousenews.com/post-ipo-woes-mount-for-pivot...
- deleted 6y ago
  [deleted]
samhuk 6y ago
throwaway may have a good point. Also, kudos on joining VMware. I'm not doubting your experience here, but financial security firms vary hugely on their opinions and eventual implementation of compliance. In my experience, dealing with a business like Monzo and dealing with the back-office department of JPMorgan (these are not exact to me for security reasons), are worlds apart. There are financial firms I've dealt with which will simply not sign off on something like the highest-of-high level build chain tools.
- jacques_chester 6y ago
  > I'm not doubting your experience here, but financial security firms vary hugely on their opinions and eventual implementation of compliance. I agree! That was my point: finance folks are not universally in favour of X or Y. Within any firm there is vast heterogeneity. Just as some will never accept buildpacks, some will never accept anything less.