Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by r3bl on Saturday April 27, 2019 @06:11AM (#19764806)

There's a good chance that someone who can modify your base image can also modify the checksum you're showing to whatever is the new checksum.

For example, when Linux Mint's ISOs were briefly backdoored, the attackers also changed the checksum shown on the website: https://www.zdnet.com/article/hacker-hundreds-were-tricked-i...

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by jjeaff on Saturday April 27, 2019 @07:23PM (#19768260)

But that's not the point here. The point is that you choose an image and verify that it is safe and then pin the hash. So I can pull that hash a thousand times over from whatever source I want and I can be sure it is always the same image that 8 originally verified. I don't care who has it or who now has control over the site because if the image doesn't match the hash, then it isn't mine.

[ Parent | on HN ]