Hacker News Reader

Comment by tzhenghao | Hacker News Reader

Tragedy of the commons - only need a few bad actors to ruin it all for us. Almost all distributors face this problem, from Docker Hub to PyPI. This also reminded me of official Postgres Docker image running a cryptominer in the background [1]

[1] - https://github.com/docker-library/postgres/issues/770

View on HN

It doesn't seem like the linked Github issue really backs up the claim that malware was getting shipped in the official image? The OP kept claiming that (even titling it `[Confirmed]`), but only one other person was able to corroborate the claim and their image hashes didn't match any of the hosted ones.

Reading that thread it doesn't seem like the official image shipped with any cryptominer at any point, and that it's more likely that the container got compromised in other ways. (A compromised [superuser connection to Postgres can execute shell code](https://medium.com/r3d-buck3t/command-execution-with-postgre...), so that seems more likely than the image shipping with a miner)

Several other issues also mention this problem across versions, with one issue mentioning that changing the default password fixed the issue.

It looks like the miner was installed because the Postgres port got exposed with a weak password.

That is a very interesting read. The maintainers seem more sane than Antender. Im even sympathetic to many of his points but he cant be sure a maintainer put a cryptominer in the image. Shouldnt be so fast to point fingers.

Are there any aggregators of interesting github issues? Links with a bit of context about them make for some fascinating reads.

Reply on news.ycombinator.com