4 ms·

This is one reason I switched to Alpine from Debian as a base. It's has literally 0 security issues. The auditors love it and I love the small size and speed. W

by _wldu 6y ago

This is one reason I switched to Alpine from Debian as a base. It's has literally 0 security issues. The auditors love it and I love the small size and speed. Win win.

cratermoon 6y ago
From the article: > this image has every security update put out by Debian But the scanner still flagged it.
- _wldu 6y ago
  Right, but audit doesn't care about that. They just see the number of reported vulnerabilities and flip out. Make that better! Fix that! Alpine to the rescue. Do you want to spend time in meetings explaining why 100+ CVEs are nonsense or would you rather get Alpine up and running? I know which I would have more fun doing ;) I know, it's not really an issue (from a security perspective) but try explaining that to an audit manager who only wants to get a 'good' report for the board. This is really more of an indication of what is wrong with the security industry.
  - cratermoon 6y ago
    That's fair, but you might run into another wall if the people worrying about the nonsense CVEs are also resistant to Alpine for other reasons.
    - GordonS 6y ago
      IIRC, there is a slight performance penalty with Alpine, compared with glibc - are there any other reasons to be resistant to Alpine?
      - cratermoon 6y ago
        Yea, in an "enterprisey" organization you'll have auditors who will note that it doesn't have XYZ SoopEr SeCure Certification v3.141 and there isn't an Alpine LTS Enterprise Edition with White Glove Support.
  - 0xbadcafebee 6y ago
    Every industry and workplace has robotic people who just want to check off a form. In each case you have to engage with them (or somebody else) to address the immediate problem, like "this report is inaccurate". Usually I send an email explaining my position and CC my boss, my boss's boss, and the robot's boss, and if they're good managers, they'll fix it.
raesene9 6y ago
Alpine is useful, but there are some things to watch.Specifically it has quite a short support lifecycle, so if you don't bump the tags it'll get out of support quite quickly.
eeZah7Ux 6y ago
It has 0 issues that you know of. Yet, the kernel it just the same...

by _wldu 6y ago

This is one reason I switched to Alpine from Debian as a base. It's has literally 0 security issues. The auditors love it and I love the small size and speed. Win win.

cratermoon 6y ago

From the article: > this image has every security update put out by Debian But the scanner still flagged it.

_wldu 6y ago
Right, but audit doesn't care about that. They just see the number of reported vulnerabilities and flip out. Make that better! Fix that! Alpine to the rescue. Do you want to spend time in meetings explaining why 100+ CVEs are nonsense or would you rather get Alpine up and running? I know which I would have more fun doing ;) I know, it's not really an issue (from a security perspective) but try explaining that to an audit manager who only wants to get a 'good' report for the board. This is really more of an indication of what is wrong with the security industry.
- cratermoon 6y ago
  That's fair, but you might run into another wall if the people worrying about the nonsense CVEs are also resistant to Alpine for other reasons.
  - GordonS 6y ago
    IIRC, there is a slight performance penalty with Alpine, compared with glibc - are there any other reasons to be resistant to Alpine?
    - cratermoon 6y ago
      Yea, in an "enterprisey" organization you'll have auditors who will note that it doesn't have XYZ SoopEr SeCure Certification v3.141 and there isn't an Alpine LTS Enterprise Edition with White Glove Support.
- 0xbadcafebee 6y ago
  Every industry and workplace has robotic people who just want to check off a form. In each case you have to engage with them (or somebody else) to address the immediate problem, like "this report is inaccurate". Usually I send an email explaining my position and CC my boss, my boss's boss, and the robot's boss, and if they're good managers, they'll fix it.

raesene9 6y ago

Alpine is useful, but there are some things to watch.Specifically it has quite a short support lifecycle, so if you don't bump the tags it'll get out of support quite quickly.

eeZah7Ux 6y ago

It has 0 issues that you know of. Yet, the kernel it just the same...