4 ms·

Let's be real here. If Docker was 'just' an open source project, it would move at 50% of the pace and security issues like this would still not be solved. It's

by tinco 12y ago

Let's be real here. If Docker was 'just' an open source project, it would move at 50% of the pace and security issues like this would still not be solved. It's crazy to assume that if it were an open source project it would somehow get the core right faster or not expand on its ambitions. If it were just an open source project, it could focus on nothing, because Solomon would be working on something else that would actually pay his bills. It's just a young project with a huge interaction surface, they're trying to please a lot of people in a very small amount of time. No reason to panic, just wait for it to get finished. Also, Docker is an extracted product just like Rails is, and it's not really a framework so I don't think DHH's argument really applies here.

tedunangst 12y ago
Regardless of the development model, the correct ordering of implementing a feature like signature verification remains the same. 1. Write code to verify signatures. 2. Write code to print "The image you are pulling has been verified."
- tinco 12y ago
  I wouldn't disagree, obviously someone messed up here. The discussion is more about that some people believe that the fact that his bug is not being solved is a sign that the Docker team lacks focus.
tuffle 12y ago
> Let's be real here. If Docker was 'just' an open source project, it would move at 50% of the pace and security issues like this would still not be solved. That's wild speculation, and the elephant in the room (Linux), while a different beast, is a pretty strong counterexample for how being 'just' open source oesn't doom you to being slow or insecure. > It's crazy to assume that if it were an open source project it would somehow get the core right faster or not expand on its ambitions. I don't think it's crazy at all. A (say, community funded) purely open source project has no distractions and has nothing to do but to get the core right. It also has no incentive or reason to expand its ambitions.
- jqm 12y ago
  "no incentive or reason to expand its ambitions" with a nod towards systemd.
- nknighthb 12y ago
  Linux is not a counterexample. The only reason it looks different is that the primary gatekeeper and a few key developers are paid jointly and circuitously by the sponsoring companies.
- FooBarWidget 12y ago
  You took Linux as an example? It took Linux 10 years (1992-2002 - kernel 2.4) to get to a stage where it's considered widely production-ready in the enterprise. And the phenomenal development rate of the 2.4+ series is thanks to corporate sponsors hiring talented developers to work on the kernel full time. I can give you a couple of counter-counter-examples. GIMP has been around for almost 20 years by now, but its development rate is abysmally slow, still faraway from what most people expect from a Photoshop replacement. Its progress since ~2008 hasn't been that big. GNOME has been around for almost that long too, but it's constantly suffering from lack of man power. The Sidekiq background worker system for Ruby is open source, but development went much faster ever since the author started monetizing on it by selling commercial licenses. Nginx is also open source. They have much more development power now that they are a business and have a source of income. Before, it was just Igor working on it whenever he had time when he's off work.
rodgerd 12y ago
> Let's be real here. If Docker was 'just' an open source project, it would move at 50% of the pace and security issues like this would still not be solved Funny, systemd-nspawn just gained the ability to import and run Docker images. Or rather "the best known container solution".
chubot 12y ago
I don't believe Docker is an extracted product. They wrote it from scratch and pushed it on the world, without running it in production themselves. In particular, I don't believe dotCloud ever ran Docker in production / for paying customers. It seems like there were several earlier containerization technologies based on LXC or OpenVZ, but it wasn't Docker per se. They had some domain knowledge from those earlier experiences, but not production quality code.

by tinco 12y ago

tedunangst 12y ago

Regardless of the development model, the correct ordering of implementing a feature like signature verification remains the same. 1. Write code to verify signatures. 2. Write code to print "The image you are pulling has been verified."

tinco 12y ago
I wouldn't disagree, obviously someone messed up here. The discussion is more about that some people believe that the fact that his bug is not being solved is a sign that the Docker team lacks focus.

tuffle 12y ago

> Let's be real here. If Docker was 'just' an open source project, it would move at 50% of the pace and security issues like this would still not be solved. That's wild speculation, and the elephant in the room (Linux), while a different beast, is a pretty strong counterexample for how being 'just' open source oesn't doom you to being slow or insecure. > It's crazy to assume that if it were an open source project it would somehow get the core right faster or not expand on its ambitions. I don't think it's crazy at all. A (say, community funded) purely open source project has no distractions and has nothing to do but to get the core right. It also has no incentive or reason to expand its ambitions.

jqm 12y ago
"no incentive or reason to expand its ambitions" with a nod towards systemd.
nknighthb 12y ago
Linux is not a counterexample. The only reason it looks different is that the primary gatekeeper and a few key developers are paid jointly and circuitously by the sponsoring companies.
FooBarWidget 12y ago
You took Linux as an example? It took Linux 10 years (1992-2002 - kernel 2.4) to get to a stage where it's considered widely production-ready in the enterprise. And the phenomenal development rate of the 2.4+ series is thanks to corporate sponsors hiring talented developers to work on the kernel full time. I can give you a couple of counter-counter-examples. GIMP has been around for almost 20 years by now, but its development rate is abysmally slow, still faraway from what most people expect from a Photoshop replacement. Its progress since ~2008 hasn't been that big. GNOME has been around for almost that long too, but it's constantly suffering from lack of man power. The Sidekiq background worker system for Ruby is open source, but development went much faster ever since the author started monetizing on it by selling commercial licenses. Nginx is also open source. They have much more development power now that they are a business and have a source of income. Before, it was just Igor working on it whenever he had time when he's off work.

rodgerd 12y ago

> Let's be real here. If Docker was 'just' an open source project, it would move at 50% of the pace and security issues like this would still not be solved Funny, systemd-nspawn just gained the ability to import and run Docker images. Or rather "the best known container solution".

chubot 12y ago

I don't believe Docker is an extracted product. They wrote it from scratch and pushed it on the world, without running it in production themselves. In particular, I don't believe dotCloud ever ran Docker in production / for paying customers. It seems like there were several earlier containerization technologies based on LXC or OpenVZ, but it wasn't Docker per se. They had some domain knowledge from those earlier experiences, but not production quality code.