Re:Why would anyone choose Docker over fat binaries?
by gcb0 on Sunday October 29, 2017 @08:02PM
(#15582292)
zero days and the privilege escalation are a luxury.
bad code is often plaged with injection/sql injection. Which sandbox does an absolute NOTHING to protect you from. After all, it is all within the expected side effects of your code.
Re:Why would anyone choose Docker over fat binaries?
by bm1362 on Monday October 30, 2017 @01:18AM
(#15583224)
What does this have to do with Docker then?
Re:Why would anyone choose Docker over fat binaries?
by gcb0 on Sunday November 05, 2017 @10:59PM
(#15633364)
because a flawed argument in defense of containers is that it is safer, since it's harder to escalate priviledges.
my point is that false sense of security makes it even easier for an attacker to use readily available privileges in the badly coded application.
I don't think I believe that equality is nearly as neat you'd hope. Unless we're willing to call all code crap code, a lot of projects with well-respected code and development practices have had serious zero days, and we've also found that sandboxing software is highly effective. Insecure code in a secure, well-written sandbox can get you a secure deployment, and you probably want to have your "good" code in a well-written sandbox anyway.