4 ms·
https://news.ycombinator.com/item?id=40591147 https://news.ycombinator.com/item?id=40591147 So the PaaS providers mentioned in that comment should be assumed t
by parhamn 2y ago
https://news.ycombinator.com/item?id=40591147 https://news.ycombinator.com/item?id=40591147
So the PaaS providers mentioned in that comment should be assumed to be compromised?
- ahmedtd 2y agoIf they are using multitenant Docker / containerd containers with no additional sandboxing, then yes, then it's only a matter of time and attacker interest before a cross-tenant compromise occurs.
- tptacek 2y agoThere isn't realistic sandboxing you can do with shared-kernel multitenant general-workload runtimes. You can do shared-kernel with a language runtime, like V8 isolates. You can do it with WASM. But you can't do native binary Unix execution and count on sandboxing to fix the security issues, because there's a track record of local LPEs in benign system calls.