626 karma · joined March 5, 2014
https://addons.mozilla.org/en-US/firefox/addon/redirector/
https://chromewebstore.google.com/detail/redirector/
Not only do I translate x.com -> xcancel.com, but
- cnn.com -> text.cnn.com
- youtube.com -> inv.nadeko.net
- instagram.com -> imginn.com
And more.
Regular expressions allow translations of paths for the redirection, so it does not just happen at the top level.
A container escape can be caused by combinations of breakdowns in several layers:
- Kernel implementation - aka, a bug. It's rare, but it happens
- Kernel compile time options selected - This has become more rare, but it can happen
- Host OS misconfiguration - Can be a contributing factor to enabling escapes
- Container runtime vulnerability - A vulnerability in the runtime itself
- Container runtime misconfiguration - Was the runtime configured properly?
- Individual container runtime misconfiguration - Was the individual container configured to run securely?
- Individual Container build - what's in the container, and can be leveraged to attack the host
- Running container attack surface - What's the running container's attack surface
The last two are included to be complete, but in the case of the original article running untrusted python code makes them irrelevant in this circumstance.
My point you must consider the system as a whole to consider its overall attack surface and risk of compromise. There is a lot more that can go wrong to enable a container escape than you implied.
There are some people who are knowledgeable enough to ensure their containers are hardened at every level of the attack surface. Even then, how many are diligent enough to ensure that attention to detail every time? how many automate their configurations?
Most default configurations are not hardened as a compromise to enable usability. Most people who build containers do not consider hardening every possible attack surface. Many don't even know the basics. Most companies don't do a good job hardening their shared container environments - often as a compromise to be "faster".
So yeah, a properly set up container is hard to escape.
Not all containers are set up properly - I'd argue most are not.
Partially correct.
Many container escapes are also because the security of the underlying host, container runtime, or container itself was poorly or inconsistently implemented. This creates gaps that allow escapes from the container. There is a much larger potential for mistakes, creating a much larger attack surface. This is in addition to kernel vulnerabilities.
While you can implement effective hardening across all the layers, the potential for misconfiguration is still there, therefore there is still a large attack surface.
While a virtual host can be escaped from, the attack surface is much smaller, leaving less room for potential escapes.
This is why containers are considered riskier for a sandbox than a virtual host. Which one you use, and why, really should depend on your use case and threat model.
Sad to say it, a disappointing amount of people don't put much hardening into their container environments, including production k8s clusters. So it's much easier to say that a virtual host is better for sandboxing than containers, because many people are less likely to get it wrong.
The kata-containers [1] runtime takes a container and runs it as a virtual host. It works with Docker, podman, k8s, etc.
It's a way to get the convenience of a container, but benefits of a virtual host.
This is not do-all-end-all, (there are more options), but this is a convenient one that is better than typical containers.
Start here to help give you ideas for what to research:
https://linuxsecurity.com/features/what-is-a-container-escap...
My username is a dumb old name, but it's the one I have.
When the non-profit tried to advertise the art festival on Facebook. Facebook not only denied them, but when the non-profit asked for a review of the denial they were warned if they asked again their entire facebook page would be flagged and deleted.
Facebook is large enough I cannot imagine their reasoning. They very likely have several conflicting streams of logic depending on teams involved. One thing I think is reasonable is that money is a motivational factor for Facebook.
Put simply, organizations who come in immediately spending money on advertising are more likely to be fast tracked. Organizations who don't spent a lot of money are more likely to be shut down. ("you've been a freeloader all this time who will likely not pay sustainably after this one-time payment. We're focusing on sustainable paying customers, goodbye")
Addition: Now that I think about it, I wouldn't be surprised if there is a literal metric of "money/time" ratio. The more money you spend in less time likely improves your chances of being fast-tracked, thus biasing new accounts who immediately spend on advertising over existing ones who sparsely pay.
My blogging and publishing almost never comes up during an interview. Afterwards, I am openly told it's why they either asked for me, or why they chose me over another candidate. This has happened at almost every job I've accepted.
My writing style or content is not all that special. As the saying goes, 90% of success is simply showing up.
Just being explain complex topics in simple ways can go a long way, even if you're not an amazing author.
---
Addition: This is especially true with topics so expansive that even great LLM often conflates subtopics in weird ways. While this gap is rapidly closing, being able to clearly explain complex interconnected topics in simple ways is absolutely an advantage.
Why did you automatically assume the point of bias?
I feel like this article makes a lot of valid observations, but then wraps them with a false dilemma.
If it had tried to convince the reader of understanding what formatting needs are required before choosing a format, I would have entirely agreed with it.
Instead I'm left feeling mildly offended, and disagree with it.
I remember the same sentiment when I was a teen and the sentiment was common among my peers.
The times have changes significantly, and what is available to teens is very different now than what it was even 5 years ago.
That said, the teen brain likely has not changed much in that time. (trying to assert independence, be different than their parents, do what they want, trust what they want, etc)
I also recall reading a while back that it's also a dopamine trigger. If you make people feel better using your app, they keep coming back for another fix. At least until they realize the hollow nature of the affirmations and start getting negative feelings about it. Such a fine line.
I might say when they have an opinion on something it can be very specific.
We're driving anything that cannot be containerized to lift and shift to IAAS and forcing the app owners to pay for it out of their budget as motivation to modernize. They have to explain to the board why their spending increased and they are still on legacy.
- [1] - https://www.talos.dev/
It was surprisingly great for the time. Apparently I was one of their 4 customers, too!
Am I being paranoid? Probably, but given recent history I don't think so. Would I ban them for that? Dunno, but it would be a consideration.
Either way, I don't find the decision to ban someone from contributing for that to be all that surprising.
I fell a lot more learning on snowboard than on skis.
Skis had a much quicker early learning curve, and made me feel over-confident. Several times I found myself on trails too steep for my skills, and the skis made me have to work hard to recover. Most of the techniques I learned as a beginner didn't work beyond green trails, and blues, blacks all required new, harder, techniques.
With snowboarding, because I fell a lot more early, my confidence slowly grew. Meanwhile the techniques I was learning on the greens, and the tool in general, that were HARD to learn on the greens were actually EASIER on the blues, and continued to work on the black-diamonds. Granted I also had to learn new techniques on the harder trails, but the beginner techniques and the slower development made me MUCH more confortable across the whole mountain much faster than skis.
Double-blacks are more like unsafe rust. :-D
That said I remember how happy I was with Z-Modem when it came out.
Before I had an error correcting modem with lots of line-noise I thought Z-Modem with it's built in error correction, ability to resume an interrupted download, and even auto-downloading (not having to tell my terminal to download) felt like magic!
Kinda funny, I was learning about file-system data recovery and forensics around 1999-2000 and was impressed with how much data that could be retrieved from slack-space [1] on hard drives. I had originally learned this on FAT based file systems. Wanting to expand my skills, I built a linux kernel with all the available file systems at the time, including ReiserFS and then created files systems to experiment with. I was surprised to find that there was no slack with ReiserFS. Without getting more long winded, that caused me to take a closer look at it. Put simply it got my attention.
By around 2001 I was using it on my personal workstations and occasional laptop. Eventually it even made it onto my personal co-located servers. At the time I had the delusional idea of making my own security-focused linux distribution, so I was re-installing my devices frequently. Probably why I never had an issue with failure.
The one exception was one of my co-located servers that I used for version control that was online with reiserfs for almost 2 years without issue. I migrated to a different server and rebuilt that one before it failed.
(edit) I almost forgot - Something I did really /love/ about it was that it handled filesystems with many (hundreds of thousands) of tiny files, symlinks, and directories without breaking a sweat. I was using it as a weird document/graph-oriented database for an app I wrote and was experimenting with (2002-ish?). Now I remember its architecture I'm surprised how well it worked considering I was too inexperienced to understand what indexes were let alone how to use them.
All other file systems I tried that with would run out of i-nodes and become incredibly slow at a mere fraction of what the reiserfs based version was able to achieve.
[1] - https://www.techtarget.com/whatis/definition/slack-space-fil...
Broadband - especially 1+Gbps connections (we are spoiled and I love it!)
Latency that can be measured in milliseconds per packet around the world, not seconds or minutes per character.
Multitasking not just locally, but across a network
Streaming video when I remember a 320x240 image taking FOREVER to download
Downloads that actually complete and don't corrupt most of the time.
Stateless connections that are easy to restart if something does go wrong
And so much more.
"Do you own a computer?"
This was due to the fact that most of the people who called for support didn't understand what a CD-ROM was, and tried playing it in their CD music players.
That reminds me of one of the most popular questions in their chat rooms by the late 90's: "A/S/L?" While it did bleed over into other services, it was very AOL-centric. I'm happy it has long since faded into obscurity.
I completely forgot AOL used to be Q-Link.
Related memory: I was using still using a 300 baud modem with my C=64 when Q-Link launched. It was rather disappointing after having used other BBS for free. The same with AOL after having been using Gopher, IRC, Anonymous-FTP years prior.
But heck, they got my dad - and a lot of people who never used computers before - to learn how to send email. I did not appreciate the scale of how impressive that was until decades later.
I'm also impressed this many random memories popped up. Unexpected.