upvote

points

by gchamonlive9 hours ago |
comments
upvoteby brookst9 hours ago|
next
[-]
I don't know about worse. Imagine a world where there is no OS authority, each app does their own. Do you think all important apps would be updated in 10 days, including auto-updates?

Apple fucked this up, but I really don't think the situation is "as bad if not worse" than if MacOS just didn't do this.

reply
upvoteby mikepurvis8 hours ago|
parent|
next
[-]
Isn't that the world that Docker gives us, basically?
reply
upvoteby Shish2k8 hours ago|
parent|
[-]
Yes - difficulty in shipping security updates to a hundred different container images, each of which is vulnerable in their own slightly-different way because they all decided to ship an OS alongside their app - is one of the top criticisms of the docker way of doing things
reply
upvoteby stephbook5 hours ago|
parent|
next
[-]
Just run it in kubernetes and mount the certificates with trust-manager
reply
upvoteby xp848 hours ago|
parent|
prev|
[-]
What kind of psychopath ships 100 distinct container images? I mean, maybe if you’re talking about all of Netflix or something, but… I suspect even they have base images that they use as a starting point.

There’s very little actually running in a docker container. ca-certs may actually be an exceptional case though, since it’s not code that’s running but a kind of data.

It’s not like if you use an Ubuntu image for a node.js app that you get PHP too and have the PHP vulnerability present in your web app.

reply
upvoteby stackskipton7 hours ago|
parent|
[-]
You still have to rebuild each Application Container with new CACert and deploy them. Depending on teams are working, that can be disruptive.
reply
upvoteby anamexis7 hours ago|
parent|
[-]
I would say that if rebuilding your docker containers is a disruptive process, that is a process issue.
reply
upvoteby stackskipton6 hours ago|
parent|
[-]
I would agree but it doesn't change the fact that many companies do not have CD and have processes that must be followed for rollouts.

It's same problem we have when libraries get massive security vulnerabilities. Updating them is not always as easy as many would like.

reply
upvoteby lakeviewterrace7 hours ago|
parent|
prev|
next
[-]
> Imagine a world where there is no OS authority, each app does their own.

That's the world we live in now thanks to Google and Mozilla.

reply
upvoteby gchamonlive9 hours ago|
parent|
prev|
[-]
It makes no sense to imagine this hypothetical scenario and compare it to reality, you have to imagine a similar world with a OS authority, but it only gets updated every 6 months. Which is worse in the worse case? I'd say the one with the lower blast radius.

But this abstract exercise is only to highlight the importance of Apple getting its shit together, because such a scenario exists with Windows and the culture of downloading exes and msis and it's honestly way worse than having a central but responsible authority.

reply
upvoteby sfoley7 hours ago|
prev|
[-]
Remember this is the same company that demands they're the only ones who can possibly decide what software their users get to install.
reply