News for hackers. Stuff that matters.

A comment on XZ Utils Backdoor Still Lurking in Docker Images. Parent comment

Re:XZ Utils Backdoor Still Lurking in Docker Images by jiggawatts on Tuesday August 19, 2025 @01:31AM (#44948535)
Let's say you have image "ProdWebAppFoo-2025-08-01" and you used this to deploy three VMs in a scale set or whatever.

Then a developer deploys their "loose files" on top a couple of times, so now you have the image plus god-knows-what.

The VM scale set scales out.

What version of the app is running on which instance?

Answer: Mixed versions.

[ Parent | on HN ]
Re:XZ Utils Backdoor Still Lurking in Docker Images by charcircuit on Tuesday August 19, 2025 @01:44AM (#44948595)
>so now you have the image plus god-knows-what.

Rsync is smart enought to figure out how to get parity.

>What version of the app is running on which instance?

There is always going to be a time during a rollout where there are mixed versions running.

[ Parent | on HN ]
Re:XZ Utils Backdoor Still Lurking in Docker Images by jiggawatts on Tuesday August 19, 2025 @04:05AM (#44949387)
Sure, rolling forward you expect mixed versions.

Nobody expects a month old version to occasionally turn up and then mysteriously disappear when some rsync job catches up.

[ Parent | on HN ]