Tag Info

New answers tagged

1

When you type "sudo [software]", it will Always assume the software needs admin rights. Thus, the OS will ask for the password, Before the process [software] has a chance to run at all. However, you have a risk, and that is when you have sudo set to "remember" your authorization for a preset time. This is default behaviour, and I Think the time is set to 5 ...


0

The whole idea that there needs to be a path from Alice to Doris is incorrect. There just needs to be a valid certificate chain from Doris to a trusted certificate in the trust store of Alice. And Doris - of course - needs to prove that she has the private key. So all Alice requires is a trusted certificate A, C or the certificate of Doris (explicit trust). ...


0

I think you need to be more specific about what you mean by "What happens if Alice explicitly does not trust C." Alice, and only Alice, has decided not to trust C, or A has revoked C's certificate? My understanding of Alice's (abstract) process is: // find a signature that she can verify 1. Alice will see that cert_Doris is signed by cert_C and ask "do I ...


4

It's best to consider a Docker container to be the same as running an application on the host system. There are some attempts to lock down the Docker daemon by removing Linux Kernel capabilities, but this is not really a guarantee. If you do run Docker, there are a few things you can do to help mitigate some of this risk. SELinux - Enabling this will ...


0

With Docker specifically, in my experience, you can trust the vast majority of stuff out there in the open source community (like stuff on Github) to not be deliberately malicious. You can read the Dockerfile, and verify it's pulling in code from official repos if any (versus using some random person's fork). If it's pulling in code from somewhere strange, ...


5

In essence, I argue it is the same question as whether open source software is trustworthy. But I think the risk of using community Docker containers is somewhat higher at present than the risks of using open source software. First, as you mentioned, there is no signing and verification now. Good open source packaging systems today include this, at least ...


1

You can build trust in the source by a quick investigation but a more fundamental concern is the relative immaturity of the overall security profile as suggested by the need to use root access to run your container. Since you suggest we focus on popular solutions let's consider that we are using a controlled Git based repository like Docker Hub to pull down ...


19

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software lacks good mechanisms as yet (e.g. digital signing) to check that images haven't been tampered with. For clarification to quote the recently released CIS ...


7

Trust it as much as any unsigned code that you run on your systems. Containers are just processes with some extra namespace protections on them, so that's all the protections they get. They still talk to the same kernel underneath.


-2

Assume the default stance of not trusting anything you want to bring into your environment from the outside. If it is something you really want to use, minimize the risk as much as possible by sequestering it, analyzing it, and making sure it will not do any harm. Give it as little access to your environment as possible in order to let it do what you ...


0

This by no means is a solid answer (I'd rather leave this as a comment than an answer, but I do not have the proper reputation). Depending on the network settings of your VirtualBox, if someone somehow got control of your VirtualBox, they could possibly get into your router or other devices on your network depending on settings and situation. Not to ...


1

If you can not trust your virtualisation software, you're in deep trouble. The virtualisation software can do *anything it wants) to the virtualised code (due to direct memory manipulation) but this is at the level of "Hey, can someone steal my creditcard data even if I encrypted it from memory when the memory is full of measurement probes?" (a.k.a. you ...


4

I just put some opinions from this link: If they wanted to include backdoors in VirtualBox, they would've closed the source a long time ago. Why would they spend time implementing a backdoor in open-source software that, if ever detected, would pretty much lead to everyone abandoning the software en masse? Leaving it open allows potentially thousands of ...



Top 50 recent answers are included