Hacker News Reader

Comment by onion2k | Hacker News Reader

Containers are not a magic shield that protects you from all attacks. You should still be wary of what you're running even with the additional protection they offer.

For example - https://seclists.org/oss-sec/2019/q1/119

View on HN

> Containers are not a magic shield that protects you from all attacks.

Nor are manual reviews by Apple staff...

Sure, but I’m not going to let perfect be the enemy of good. Could the review process be improved? Absolutely! But I’ll take some review over no review any day of the week.

I'd rather take my review from someone other than Apple then.

They could be (and are on Illumos and FreeBSD) if only they were designed with that from the start. Linux has always made the mistake of not designing things to be safe and secure from the outset (cgroups/namespaces, btrfs, etc.).

BSD is also an application desert compared to GNU/linux. It's always going to be a scale between user desires and security needs. BSD is rock solid but moves glacially slow. Most devs need more speed than that. Most users demand it. There's a reason despite the elitist attitude the Arch Illuminati take that people want Arch. It's a really stable bleeding edge release.

I assume you're talking about desktop applications? If so, I don't think the advantages of containerization really apply like they do on the server side.

well that took all of 1 minute:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1087

Reply on news.ycombinator.com