Jeslijar · HackerTrans

6 tháng trướcdiscuss

Pretty much. America is destined for a decline. The billionaires can make money regardless of border by always moving things around and utilizing their expansive resources for any possible loopholes and escape hatches while manipulating public policy.

Jeslijar

9 tháng trướcdiscuss

Regrettably Docker has let me know they are uninterested in taking any action.

"Hello,

This does not qualify as an infringement to our Terms of Use policy. Deprecating such images and repo(s) is the responsibility of the owner and we recommend you reach out to them. Docker advises its users to opt into using images under our official programs and offerings such as Docker Official Images and Docker Hardened Images.

Thank you, Security@Docker"

In their ToU under section 6.6, they outline how they may scan images for vulnerabilities and request the owners of said packages fix it, or simply remove it from their site. They clearly do not do this though even when notified of the high criticality vulnerability.

Jeslijar

9 tháng trướcdiscuss

Yes, I read it. Last time it was raised the same guy who announced they are doing source only distribution said they could definitely do it, then another member of the team closed it saying it wouldn't happen.

Given the developers have not replied to the thread after a day and the one who was enthusiastic is now the one doling out the information that they are no longer supporting their docker image, I highly doubt they will perform a 180 on policy and suddenly work with them to provide an official curated image. If they wanted to keep the docker image alive they would have continued updating it and not shut down community feedback begging for them to maintain it.

Docker has a vested interest in keeping popular images maintained and a billion+ download package suddenly becoming defunct is noticable to them. Minio seems to be prioritizing their commercial offering and removing support for their open source offering though. Nuking their community documentation doesn't spell anything good for the future of minio for the FOSS community.

Jeslijar

9 tháng trướcdiscuss

So that's not the same thing. Docker "official images" are a category of curated docker images. Minio is not one of them. The official curated images are here: https://hub.docker.com/u/library

The minio image is basically a community one that anyone could have created, but still shows in overall docker hub. It's created by minio themselves. I'm kind of surprised they haven't removed it, but with over a billion downloads they are easily in the top ten of whatever category they fall under creating substantial free advertisement.

Jeslijar

9 tháng trướcdiscuss

I'll let docker's security team know that an insecure, obsolete docker image is being served and the maintainers have officially acknowledged they will no longer support it.

Best to get insecure and vulnerable software out of the hands of those who may not be familiar with this CVE or their change in policy that has not gotten a press release in any way.

Jeslijar

11 tháng trướcdiscuss

Why is a month's expiration better than a year or two years?

Why wouldn't you go with a week or a day? isn't that better than a whole month?

Why isn't it instead just a minute? or a few seconds? Wouldn't that be better?

Why not have certificates dynamically generated constantly and have it so every single request is serviced by a new one and then destroyed after the session is over?

Maybe the problem isn't that certificates expire too soon, maybe the problem is that humans are lazy. Perhaps it's time to go with another method entirely.

Jeslijar

năm ngoáidiscuss

Hey, maybe you can have a better hiring practice than datadog with a 5 question test where if you get a single answer wrong in even the smallest of ways you get disqualified from getting a job with them for 6 months.

I'm guessing they lost a wealth of great talent due to this test on how to support a platform that they give to fresh off the street applicants rather than having even a modicum of training about their product. They want you to study it for free, probably as a marketing tactic - but also so they don't have to pay to train employees. it's great like cancer.

Disclaimer: I have never applied to a role with datadog, nor interviewed with them. Just had multiple friends complete the process with mixed results. Seems like you need to put in ~two full weeks of self directed study to pass their on site interview 'exam' where they don't tell you about the exam being 100% or fail (but it is!)

comments