4 ms·
> The whole container movement can be seen as putting the apps in a sarcophagus like Chernobyl Reminder: containers are not meant to be security tools. Fine-g
by goodpoint 5y ago
> The whole container movement can be seen as putting the apps in a sarcophagus like Chernobyl
Reminder: containers are not meant to be security tools.
Fine-grained sandboxing (e.g. seccomp) is. And it can be layered upon OS-level VMs.
Additionally, bundling tons of stuff together with an application (like docker but also flatpak do) is not good for security. Same for static linking. They all increase the workload of updating vulnerable dependencies.
- someguydave 5y agoHow does static linking increase workload?
- tremon 5y agoBy multiplying the number of potentially-vulnerable copies of a library by the number of ways to detect the presence of said library and by the number of ways to upgrade said libraries when found.
- goodpoint 5y agoPlus, it makes updating an application way more difficult: you need: - the distribution to recompile and test all binaries using a vulnerable dependency [x] - users to download and update all affected binaries compared to: - the distribution patching a single package - users updating that package Imagine if OpenSSL was statically linked: even the smallest fix would require users to update half of the OS. And that would discourage both maintainer and users from doing regular updates. [x] And this is assuming that thousands of automated rebuilds are possible. In reality many statically linked languages encourage locking the versions of build dependencies, making it impossible to do just one backport of a patch.
- someguydave 5y agoWhy would you need to rebuild everywhere? Couldn’t you rebuild once in a trusted place and distribute signed binaries?
- goodpoint 5y agoDistributions have their fleet of buildbots to do the latter.
- someguydave 5y agoExactly! So what difference does it make if there is one patched package or 1,000?
- someguydave 5y agoWhat if your vendor was responsible for the fix?
- tremon 5y agoThen it increases the workload of said vendor?
- someguydave 5y agoYou also forgot to divide by the number of binaries that were compiled with non-vulnerable versions of the library.