Re:51% of 4M Docker images have critical vulnerabilities
by ComodoHacker on Thursday December 17, 2020 @11:32AM
(#25457107)
>you getting 0-dayed when the most popular implementation has a vulnerability
vs getting hit when your vulnerable implementation becomes popular. Not an obvious choice indeed.
Re:51% of 4M Docker images have critical vulnerabilities
by incrudible on Thursday December 17, 2020 @11:57AM
(#25457388)
> vs getting hit when your vulnerable implementation becomes popular.
Which is not going to happen, because there's no point in publishing something that is tailored to your specific purpose.
Re:51% of 4M Docker images have critical vulnerabilities
by ivanche on Thursday December 17, 2020 @12:55PM
(#25458130)
This reminds me of one Finnish student publishing some sort of OS kernel in 1991 or so which supported only his PC-compatible machine...
Re:51% of 4M Docker images have critical vulnerabilities
by incrudible on Thursday December 17, 2020 @01:04PM
(#25458277)
Of course, who could rule out that a crappy little domain-specific parser turns into a trillion dollar industry? One should let that remote possibility guide the decision making at all times.
If, for example, a file format is really complex, it has most likely one implementation that almost everyone uses. If there is a problem with it, you will hear about it. Use that.
On the other hand, if a file format is really simple or you only need a simple subset of it, rolling your own could avoid you getting 0-dayed when the most popular implementation has a vulnerability.