3 ms·

You can't really remove dependencies in open source. It is so intertwined at this point that doing it would be too expensive for most companies. I think the so

You can't really remove dependencies in open source. It is so intertwined at this point that doing it would be too expensive for most companies. I think the solution is to containerize, containerize and then containerize some more times and make it all with zero trust in mind.

funcDropShadow 3y ago
Docker containers are not really a security measure.
- gammalost 3y ago
  It is a security measure. Sure it doesn't secure anything in the container itself. But it secures the container from other containers. Code can (as proven) not be trusted, but the area of effect can be reduced.
  - 65a 3y ago
    Only with additional hardening between the container and the kernel and hardware itself.
rwmj 3y ago
Containerizing is entirely the worst response here. Containers, as deployed in the real world, are basically massive binary blobs of completely uncertain origin, usually hard to reproduce, that easily permit the addition of unaudited invisible changes. (Yes yes, I know there are some systems which try to mitigate this, but I say as deployed in the real world.)
- adql 3y ago
  Pretty much; updating say libssl in a "traditional" system running app, or maybe 2-3 dependent apps fixes the bug. Put all of them in containers and now every single one needs to be rebuilt with the dep fixed and instead of having one team (ops) responsible, you now need to coordinate half of the company to do so. It's not impossible but in general much more complex, despise containers promising "simpler" operations. ...that being said I don't miss playing whack-a-mole game with developers that do not know what their apps need to be deployed on production and for some retarded reason tested their app on unstable ubuntu while all of the servers run some flavour of stable linux with a bit older libs...
- gammalost 3y ago
  Your application is already most likely a big binary blob of uncertain origin that's hard to reproduce. Containers allow these big binary blobs of uncertainty to at least be protected from each other.

funcDropShadow 3y ago

Docker containers are not really a security measure.

gammalost 3y ago
It is a security measure. Sure it doesn't secure anything in the container itself. But it secures the container from other containers. Code can (as proven) not be trusted, but the area of effect can be reduced.
- 65a 3y ago
  Only with additional hardening between the container and the kernel and hardware itself.

rwmj 3y ago

Containerizing is entirely the worst response here. Containers, as deployed in the real world, are basically massive binary blobs of completely uncertain origin, usually hard to reproduce, that easily permit the addition of unaudited invisible changes. (Yes yes, I know there are some systems which try to mitigate this, but I say as deployed in the real world.)

adql 3y ago
Pretty much; updating say libssl in a "traditional" system running app, or maybe 2-3 dependent apps fixes the bug. Put all of them in containers and now every single one needs to be rebuilt with the dep fixed and instead of having one team (ops) responsible, you now need to coordinate half of the company to do so. It's not impossible but in general much more complex, despise containers promising "simpler" operations. ...that being said I don't miss playing whack-a-mole game with developers that do not know what their apps need to be deployed on production and for some retarded reason tested their app on unstable ubuntu while all of the servers run some flavour of stable linux with a bit older libs...
gammalost 3y ago
Your application is already most likely a big binary blob of uncertain origin that's hard to reproduce. Containers allow these big binary blobs of uncertainty to at least be protected from each other.