gtjay

4 ms·

1.
by gtjay 10y ago
> [...] you meant (on _RHEL_ xyz is the case) [...] > Totally on me. We fight against it, but it's hard not to have the implicit context of RHEL/Fed be omnipresent on the Red Hat bugzilla. In fact, when I wrote the comment i
2.
by gtjay 10y ago
Sorry for not seeing your comment until now. Amazingly great vuln BTW. It's early in 2017, but this is probably going to be one of this year's best. It's very important for everyone to understand my advice is RHEL/Fedora
3.
by gtjay 10y ago
As I've discused before, seccomp can block ptrace and thus this VDSO-based attack (and currently does by default in some distros). Shameless self-link to that post: https://medium.com/@gtrevorjay/consider-container
4.
by gtjay 12y ago
It's all the brainchild of hatter Colin Walters (originally as part of the Gnome project). RH's just very devoted to upstreaming/dogfooding.
5.
by gtjay 12y ago
I hate that the isolation of containers gets oversold as a security feature because there is real value in what you might call "configuration isolation". Often, I am reluctant to run something not because of a trust issue but a co
6.
by gtjay 12y ago
That's interesting. The UK also has more protections for small contractors (e.g. electricians, welders, etc.). I wonder if that's the common thread (meaning it's basically impossible to replicate in the US) or if Radical Hack
7.
by gtjay 12y ago
Having moved to Australia in recent years, I was very happy to see that JayCar, their equivalent to Radio Shack, seemed to be doing quite well. This is judging by what I've seen of the stores in what is considered a fairly backwards pa
8.
by gtjay 12y ago
cool story bro
9.
by gtjay 12y ago
I'm currently living in Australia, and the rent prices are fascinating. You see, to a certain extent, the housing bubble never "popped" (sudden massive drop) here. Instead of being bundled into investments or handled by real
10.
by gtjay 12y ago
"My point is that there is no difference between software and hardware." Okay, now I see where you're coming from. Theoretically I agree. However, practically there are a number of things that make hardware different: * Hardw
11.
by gtjay 12y ago
"There's a lot of us contributing here, and much of the work isn't under the docker banner." Of course! If my comment could be taken as part of the mass of prose that can be read to imply otherwise, I apologize. I don&#x
12.
by gtjay 12y ago
You don't need super-human chip designers because, as you say, "the difficulty of containment is proportional to the interface that is available". Hardware doesn't just seem better because "the syscall interfaces of
13.
by gtjay 12y ago
This phrasing unfairly conflates VM/hypervisor technology and containers. Containers being a pure software technology do require near superhuman ability to secure but VM/hypervisors can lean on chip-level separation. People forg
14.
by gtjay 12y ago
This vulnerability is a good example of how a security bug is still a bug . That is: even if all the bad guys went away there would still be problems. This issue was fixed (as far as I can tell) pre-1.0 for non-security reasons. See this d