He’s describing literal best practices.
Comment on Beginner looking for advice on open-source NAS hardware and OS for self-hosting
moldy_rice@piefed.keyboardvagabond.com 1 week ago This comment is suggesting doing many things extremely vulnerable to supply chain attacks. Please don’t upvote or do this.
Bane_Killgrind@lemmy.dbzer0.com 1 week ago
hperrin@lemmy.ca 1 week ago
Why do you say that? Docker Hub is, of course, susceptible to supply chain attacks, as are the official containers of each of these projects, but how is that all that different from installing these projects on bare metal? And how are any of them “extremely” vulnerable?
I didn’t suggest anything that isn’t either an official build from the project maintainers, or a very well supported community build from a reputable source.
- moldy_rice@piefed.keyboardvagabond.com 6 days ago
Apt and most package managers have cryptographic verifications on all packaged by default since the 1990s.
Docker pull does not, so it will happily download a maliciously modified image, without checking.
hperrin@lemmy.ca 5 days ago
That’s because package managers are designed to use mirrors. You have to verify a digital signature because the package isn’t necessarily coming from the package maintainer’s repo.
Docker pulls come from the registry, not a mirror. There is no such thing as a mirror in docker. The registry is something you decide on, and if you don’t trust it, you shouldn’t use it. If the registry itself is compromised, that’s essentially like the private key of a package manager getting compromised. Same risk.
The two biggest registries are Docker Hub and GitHub. If either of them were compromised, it wouldn’t take very long for them to mitigate it. The damage would likely be very small.
- moldy_rice@piefed.keyboardvagabond.com 5 days ago
You’re talking about publishing infrastructure compromise
Compromise of the integrity of the traffic between your server and theirs can happen. Loads of CAs have been compromised. X.509 root stores insecurity breaks https.
Literally everything is vulnerable to supply chain attacks…
Your comment is basically saying don’t go in the sun you will get sunburned so you should always avoid the sun forever.
You HAVE to accept some level of risk if your using literally any software that you don’t make, host, and maintain yourself.
So unless you have actually decent suggestions on ways to prevent issues, improve security or some tips for a new user for best practices.
All your doing is fear mongering and being extremely unhelpful.
Apt and most package managers have cryptographic verifications on all packaged by default since the 1990s.
Docker pull does not, so it will happily download a maliciously modified image, without checking.
You can go in the sun, but wear sunscreen. You can have sex with a stranger, but wear a condom. You can download software, but check the cryptographic signature.