Hacker News Reader

Comment by viraptor | Hacker News Reader

> I'm not sure what's the alternative for servers here.

Nixos/nixpkgs: isolated dependencies / services, easy to override if needed, configs follow relatively consistent pattern (main options exposed, others can be passed as text), service files can do isolation by whitelisting paths without going full-blown self-contained-os container.

> Are you running random images from the internet on your servers?

Many home server users do this. In business use, unless you invest lots of time into this, a part of your services is still effectively a random image from the internet.

> and those from Bitnami

Yes, that's a random image from the internet.

View on HN

> Yes, that's a random image from the internet.

By that definition, you are running it on a random OS, random processor with some random network infra.

Kinda. It depends what your risk tolerance is.

But seriously, what's your business relationship to bitnami? What are the guarantees about keeping those images up to date? What are the guarantees about the feature set provided? How long will the specific image be available publicly/free? Is the base system guaranteed to stay the same? What about architecture support?

I mostly agree with GGP, but GP has a point. I'm a semi-frequent users of Docker at work and personally, and I still don't know what the fuck "Bitnami" is. I'm gonna guess now (and check later) they're probably some corporate body that fell out of whatever kerfuffle happened with Docker licensing a year or so ago; but otherwise, "Bitnami" sounds to me like "Bincrafters" from Conan/C++ world - no fucking clue who they are (the name doesn't help), but everyone sure likes to depend on what sounds like a random third party.

It's always been surprising to me how little people seem to care about the provenance of their images. It's even more surprising that infosec isn't forcing developing to start their images `FROM scratch`.

Are you compiling you os distro's `FROM scratch`?

Ther's always a certin level of trust, and for many, docker containers are just as trusty as distros from trusty orgs or volunteers.

There once was a man named Terry Davis...

I imagine anyone with a BA in CS has wrote a OS from scratch.

How many systems on chips are in a moderen computer, not the main system and cpu, but every little chip and controller, the boot system, every board seems to have a little OS.

In regards to security, its all about analysing risk and trade-offs.

For me using containers from known vendors is a risk im willing to take.

> I imagine anyone with a BA in CS has wrote a OS from scratch.

Not even close. Very few courses require anything that advanced and only some of those are non-optional.

Or for a less out-there example, Ken Thompson's classic "Reflections on Trusting Trust". At some point unless you are literally producing all of the hardware and software yourself you have to trust someone. The challenge is figuring out where that line of acceptable risk lies for you. It's going to be very different for an indie game dev vs a FinTech company vs the US DoD.

Like the other person said, Nix solves that problem.

You are in control of the entire supply chain with Nix.

If you have sources, you have full control, using any distribution method. Some Nix packages are without sources, so this is not true for Nix.

Supply chain management isn't about sources per se (though source makes it easier). What you need is hashes and signatures for every dependency at every step.

If you have sources, you can do anything you want at every step. If you haven't, then you can do fewer things at some steps. Some Nix packages have no sources, so full control is not available for them.

> Are you compiling you os distro's `FROM scratch`?

As a matter of fact, yes.

But that could be said about each an any dependency.

And some (very rare) companies do enforce that, everyone else has to build up a bit of trust.

Reply on news.ycombinator.com