Top all-time · #13566
Jonathan Rudenberg
Personal blog · titanous.com/posts · on HN as Titanoussecurityprogramming
Jonathan Rudenberg's personal blog at titanous.com covers security and programming. Since 2012, 5 different Hacker News readers have linked it 10 times, most often “Docker Image Insecurity”. The last post was in 2014, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
Posts on Docker security, containers and sysadmin practices, and a Heroku build-system vulnerability. Commenters cite them as support or further reading, and none of the comments judge the writing itself.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Docker Image Insecurity3 people · 3 mentions · first linked 2014-12-23
- Vulnerabilities in Heroku's Build System2 people · 2 mentions · first linked 2012-07-03
What Hacker News says?
It appears this was finally changed mid-March, but after initial release in December image signing initially worked as follows: Docker’s report that a downloaded image is “verified” is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest. An attacker could provide any image alongside a signed manifest. https://news.ycombinator.com/item?id=8788770 https://t…
Comment linking /posts/docker-insecurity
on “The sad state of sysadmin in the age of containers”Submitted Docker Image Insecurity as a story · 263 points
HN discussionA number of issues discussed in the article would be factors regardless of the scale: --logging, secrets, edgy kernel features, security Also, see https://titanous.com/posts/docker-insecurity
Comment linking /posts/docker-insecurity
on “Why Docker Is Not Yet Succeeding Widely in Production”Submitted Vulnerabilities in Heroku's Build System as a story · 170 points
HN discussionThere are two important pieces to your Tent identity. 1: Your Entity (this is the url you're referring to. I could be https://jonathan.tent.is and then change to https://titanous.com ). Think of entities like a name. You can change it but you really want to think carefully first. Other Tent servers know you by your entity. If all you told someone was your entity ( https://spindritf.net ) their Tent server would cont…
Comment linking /
on “Tent.is alpha”Submitted SMS Vulnerability in Twitter, Facebook, and Venmo as a story · 42 points
HN discussionIt did lead to an interesting exploit though - http://titanous.com/posts/vulnerabilities-in-heroku-build-sy...
Comment linking /posts/vulnerabilities-in-heroku-build-system
on “Keeping Passwords in Source Control”Submitted Security Disclosure Policy Best Practices as a story · 15 points
HN discussion- pw · 2015-08-10
Submitted Brown M&M's, Tesla, and Security as a story · 1 points
HN discussion