Hacker News Reader

"version + hash" is ugly though. I trust the publisher of my base image to keep compatibility even if they update their image and trust my test suites to detect any issues, so I just use version without the hash nowadays.

View on HN

> I trust the publisher of my base image to keep compatibility even if they update their image

That's how we get hacks like SolarWinds and MOVEit.

Using hash doesn't protect you from supply chain attack either. If the publisher is compromise, any updates could potentially be malicious. The alternative is to never update at all, which can be even worse.

It doesn't completely protect, no. Nothing does. Like much in security, defense in depth is the byword. Not checking the hash throws away a layer.

Reply on news.ycombinator.com