4 ms·
To avoid this kind of security problem, use providers that use official Ubuntu Cloud images only. If Canonical haven't certified the Ubuntu images you're using,
by rlpb 13y ago
To avoid this kind of security problem, use providers that use official Ubuntu Cloud images only. If Canonical haven't certified the Ubuntu images you're using, then your provider could have done anything to them. You'll need some other way to determine their competence.
Cowboy images like this are exactly the reason trademarks exist. Commercial providers who don't get certification are in fact violating Ubuntu's trademark by telling you that you are getting Ubuntu, when in fact you are getting a modified image which is possibly compromised (such as in this case).
- regularfry 13y agoHow do I validate that my provider is actually providing an official Ubuntu Cloud image?
- rlpb 13y agoTechnically? I'm not sure that's possible. They own the hypervisor, so you have to trust them. This is why the Ubuntu trademark is so important.
- regularfry 13y agoIf I have to trust them because they own the hypervisor, the fact they claim to deliver a "certified" image buys me nothing in terms of security.
- rlpb 13y agoThat's demonstrably not the case. In this situation, it was only the modified image that accidentally introduced a vulnerability. The official image does not have this vulnerability. Had you been using an Ubuntu certified cloud, you wouldn't have been vulnerable.
- regularfry 13y agoI've got no way to check I am using an official image, other than knowing that at some point in the past, my provider bunged Canonical some cash for the "Ubuntu Certified(tm)" sticker. Without knowing a lot more about how certification works, that's not a particularly strong proof.