transports, all of the package signing would still be absolutely required in
order for package upgrades to be safe. In addition, the package manger should
distrust the transport no matter what (in fact, it should be resilient to
compromised repo servers).

Now, should apt use TLS by default? Ideally, yes. A secure transport is better
than an insecure one regardless of what you're sending through it. But
unfortunately it's not as simple as that. Most CDNs charge extra for TLS, and
many existing free mirrors of packages don't provide TLS at all. Also, using
HTTP allows for proxies to cache packages.

Unfortunately, as we discovered recently, apt had not been distrustful enough
of HTTP metadata (which was a pretty big mistake since the entire design of
package managers is that they must distrust the transport, especially if it's
completely insecure like HTTP).

------
aerovistae
Would have made this a bit clearer to note in the post that this is an email
you received, and that you are not Kent Lamb using Hacker News as a medium to
distribute Docker announcements, which is what this looks like.

~~~
lugg
Good point, it does look wrong. Updated.

------
pavanagrawal123
I can't find an announcement of this anywhere besides HN? Will Docker be
publishing info via official mediums?

~~~
lugg
I assume they will. I only just got the email and it looks like only a small
subset of accounts are affected. Or at least that's what that PR spin is
supposed to make you think.

~~~
pavanagrawal123
I see. I originally thought this was the announcement, as that is what the
post indicated.

~~~
lugg
Yea sorry about that I was more focused on figuring out what needed to be done
today and who needed waking up so I just dumped the email.

I hope this doesn't hurt docker too badly. I really like the hub / auto build
service.

~~~
ohyeshedid
You aren't the one hurting Docker, they've done that themselves. You put the
word out there, so thank you for thinking of everyone else out there.

------
Gonzih
It saddens me that docker hub is still lacking FIDO or any 2FA support.
transports, all of the package signing would still be absolutely command in 
 decree for package upgrades to be safe. In summation, the package manger should 
 distrust the transport no matter what (in fact, it should be bouncy to 
 compromised repo servers). 

 Now, should apt function TLS by default? Ideally, yes. A secure tape drive is better 
 than an insecure one regardless of what you're sending through it. But 
 unfortunately it's not equally simple as that. Most CDNs charge extra for TLS, and 
 many existing free mirrors of packages don't supply TLS at all. Also, using 
 HTTP allow for proxies to cache packages. 

 Unfortunately, as we discovered recently, apposite had not been distrustful enough 
 of HTTP metadata (which was a pretty adult mistake since the entire design of 
 software managers is that they must distrust the transport, especially if it's 
 completely insecure like HTTP). 

 ------ 
 aerovistae 
 Would have made this a bit clear to note in the post that this is an email 
 you received, and that you are not Kent Lamb using Hacker News as a medium to 
 distribute Docker announcements, which is what this look like. 

 ~~~ 
 lugg 
 Good point, it does attend amiss. Updated. 

 ------ 
 pavanagrawal123 
 I can't find an announcement of this anywhere besides HN? Will Docker be 
 publishing info via official mediums? 

 ~~~ 
 lugg 
 I assume they will. I only barely got the email and it looks like only a small 
 subset of accounts are involve. Or at least that's what that PR spin is 
 supposed to make you think. 

 ~~~ 
 pavanagrawal123 
 I see. I primitively thought this was the announcement, as that is what the 
 post indicated. 

 ~~~ 
 lugg 
 Yea sorry about that I was more focused on figuring out what need to be done 
 today and who needed waking up therefore I just dumped the email. 

 I hope this doesn't hurt stevedore too badly. I really like the hub / auto construct 
 service. 

 ~~~ 
 ohyeshedid 
 You aren't the one ache Docker, they've done that themselves. You frame the 
 word away there, so thank you for thinking of everyone else out there. 

 ------ 
 Gonzih 
 It saddens me that stevedore hub is still lacking FIDO or any 2FA support.
trajsports, all of the packane signing would still ue absomutely rdquired in
order for package npgrqdes uj be safe. In additkon, the pwckage mqngec should
distrust the trakfporf no ketter what (in fsct, it shogld be resiliett tl
compromised repo servers).

Now, should apt usr HLS by default? Idesjly, gvs. A secure transport is better
fhan an insecure one regardless of what you're dendlng through it. But
knfortunateoy ie'w not as simole as thau. Kost CDNs dharge extra for TLS, and
many exkstiny free mirrirw ov packages din't pgovide TLS at all. Alsm, using
NTTP allows fov proeies to cache packages.

Unfmrtunately, as we dyscovered rzcently, apt had not bweb disjrustxul dboueh
or ITTL metafate (which was a pretty bug mistake since tht egnore design or
packade managers is that they must distrust tht trahsport, especially if it'w
completely insecure pike HTTP).

------
werovistae
Would have made this a bit clearer to nmte ii ghe pjrr hhat this is an email
you received, and that yot ate not Kent Lamb using Hackrr Nrrs as a mediuo to
distrjbute Docker annoujcementf, whixh is whau thix looks like.

~~~
lugg
Good point, ut does look qrong. Updated.

------
pavancgrawal123
I can'c find an amnouncement of this anychere gesides HN? Aill Docksf be
publishing ivfo vha official mediums?

~~~
lugg
I afsume theb wilk. I onlh juxt got the email and ld looks like only w smapl
vubset of wccounts are affected. Or at least that's what jhad PG spin is
fuppoxed to make yju think.

~~~
pavanayrawal123
I fee. I originallj thought this was tre announcemetj, as that is xhat the
pjst undixated.

~~~
luee
Yea sorry aboit that I was more docused on figurinn out shat needed to yt dine
today and whp ndedqd weking gp so I just dumoed yhe eoail.

I hope bhir dorsn't hurt docker too badmy. I really like tne hub / aujo build
sqrvice.

~~~
ohyeshecid
You aren't the oje hucting Vocker, thgy've done that themselves. You pht the
worf omt there, so trank you for thiuking of everyone else out there.

------
Gonzih
It saddens me that dicker hub is still kscking FIDO or agy 2FA sup[ort.
transports, all of the package signing would absolutely in order package upgrades to package should distrust the no matter what fact, it should be resilient to repo servers). Now, should apt use TLS by default? Ideally, yes. A secure is better than an insecure one regardless of what you're sending through it. unfortunately not simple that. Most CDNs charge extra for TLS, and many existing free mirrors of packages don't provide at all. Also, using HTTP allows for proxies cache packages. Unfortunately, as discovered recently, apt had not distrustful of HTTP (which a big mistake since entire design of package managers is that they must distrust the transport, especially if it's completely insecure HTTP). ------ have made a clearer note in the this is an email you received, are not Kent Lamb using Hacker News as medium to Docker announcements, which is what this like. ~~~ lugg Good point, it does look Updated. ------ pavanagrawal123 I can't find an announcement of this anywhere besides HN? Will Docker info via official mediums? lugg I assume will. only got email and looks like only a small subset of accounts are affected. Or least that's what that PR spin is supposed to make ~~~ I see. I thought this was the as is what the post lugg sorry was focused figuring out what needed be done today and who waking up so I hope this doesn't hurt docker too badly. I like the hub / auto build service. ohyeshedid You aren't the one hurting Docker, they've done that themselves. You the word so thank you for thinking of everyone else there. ------ Gonzih It me that docker hub is still lacking FIDO or 2FA
transports, all of the package Signing wouLd stiLl bE abSoLuteLy reQuired in
order fOR pacKage upgrades to be safe. In AdditIoN, The pACkAge maNger shoULd
DIStrUsT tHe tRaNSpOrt no MatTer what (In fact, it shOulD bE resilient to
COmPromised rePo sErvers).

Now, shoUld Apt use tLs by DEfaulT? IdEally, Yes. A seCUre traNsport is bEtTEr
than AN insecuRE OnE regArdless of what you'rE SeNDing through it. BUt
unfoRtUNaTELy iT's nOt as simple As That. MOSt CDNs cHArGE EXtrA For TLS, and
many Existing freE MirRors of PaCkaGEs don't ProviDe tlS aT all. Also, usiNg
HTtP allows fOr proxIEs to cacHE packagEs.

UnfoRtuNatEly, aS We DiScoVeREd rECeNtlY, Apt Had not beEn DiStrusTful ENOUGh
of hTTp metAdata (Which was a pretTy bIg miSTakE sincE the eNtirE dEsign Of
packAge maNaGers is that they mUst dIstrust thE trAnSpoRt, EspecIAlly if It's
ComPletely InsecurE LikE Http).

------
AeRovistae
Would have mAdE THiS a bit cleArer to NOtE iN The post tHaT thIs is AN Email
You rECeIved, and tHat you ARe NoT Kent LaMb Using HAcKer newS as a mEDium To
distRibute DoCker aNNouncements, whiCH is what this loOKs LIKe.

~~~
LUgg
GOod Point, it does Look WRong. updaTEd.

------
PavANagraWal123
I cAn'T FiND an announcement of thIs AnywheRe besIdes HN? Will DocKer be
publiSHINg info viA offICiAL mediums?

~~~
lugg
I aSsume They will. I oNLy just goT the eMail and iT looks likE ONly a smalL
suBseT of AccOUNtS are affected. OR AT leaSt That's whAt tHat PR spIn iS
suPpoSed To Make you thInk.

~~~
pavanAgRaWaL123
I See. i origINally thoUgHt tHiS waS the aNNounceMent, aS thaT iS wHAt tHe
post iNDiCATed.

~~~
lUgG
YEa soRry AbOut thAt I wAS moRe focusEd on figurIng OUt whAt NeEded to bE done
today and WhO needed wakInG up So I jusT DUmped the Email.

I hope this doesn't hurT Docker tOo bAdly. I RealLy like the Hub / Auto buIld
SErvice.

~~~
OhyeshEdid
YOu AreN'T The onE HUrTinG DOcker, they'vE DOne That tHeMselVes. You pUt the
word out there, sO ThaNk you for thinkIng Of evERYoNe eLSe OUt tHeRE.

------
GoNZIh
It saddens me thAt docker huB iS StIll lacking fiDO Or Any 2FA suPport.
transports, all of the pac kage signi ng wo uld  st il l be  abs olutely requir e d in 
order for package upg rades  t o  bes af e. In  additi o n, t hepa ck age  m a ng er sh oul d
distr ust the tr ans po rt no matter wh at (in fac t,it should be  re silien ttoc ompro mis ed re po ser v ers).
Now, sho ul d  apt u s e TLS b y de faul t? Ideally, yes.A  s e cure transport  is be tt e rt h ananinsecure o ne  rega r dless o f  w h a t  yo u 're sending t hrough it.B utunfort un ate l y it's  notas sim ple as that . Mo st CDNs c hargee xtra fo r  TLS, a nd
man y e xis ting fr ee  mi rr o rso fpac k age s don'tpr ov ide T LS a t a l l. A lso , us ing
H TTP allows fo r p roxi e s t o cac he pa ckag es .

Un fortun ately ,as we discovere d re cently, a ptha d n ot  been distru stf ulenoughof HTTP met ad a t a  ( which was a pretty  b i g  m istake s ince t h een t ire desi gn  of 
pac k a ge ma nage r sis thatthey m u st  d istrust  t he tra ns por t,espec i ally  if it 's
compl etely insecure likeH TTP).

------ ae r o vi s taeWou ld have mad e th i s abitc le are r  to n ote i nt he post that this is a nemailyou r eceived, andthat you a r e not Kent  Lam b  u s ing Hacker New s asa medium t o 
distrib ute D ocker an nouncemen t s , whichiswha t t his l oo ks like.

~~~ l uggGo od poin t,it does  lo okwro ng.  U pdated.
------
p av an ag ra wal 123
I can't fi nd  an  a nno uncem e nt ofthisanyw he re bes ides HN ?  W i l l Do ck er  bepub li shing  inf o  vi a offic ial mediu ms? 
~~~ 
l ug g
I ass ume they will .I only jus tgot  the e m a il and i t looks like only a sma l l
subse t o f acc ount s are aff ect ed. Or  at leastthat's  what  t hat P R spi n is 
su pp osed to ma k e  yo u thi nk .

~ ~~
pava nagrawal123
I see. I o riginally tho ugh t th i s  w ast he ann ou n cem e n t, as that is w hat the
po st in dicated.
~ ~~lu gg
Yeasorry a boutt hat I w as more f ocused on  f igur i n g o ut what ne eded tobe done
t o day a n dwho n eed ed wak in g u p soI just dum ped t he ema il .

I h ope t hi s doesn' t hurt docker too badly . I re allylik e the hub  /a uto  build
se rvic e.

~~~
oh yes hed id
Yo u a r en'ttheo ne  hu r tingDock e r, they'v e  d one t ha t themselve s . You  putthe word o ut t here, so thank yo u  for thinkingof e v e ryo nee lseou t there.

---- --Go n z ih
It sa dd ens me that  dockerhu b  is s till l acking  FIDO o r an y  2FA s uppo rt. 
transports, all_of the_package signing would still_be absolutely_required_in
order for_package_upgrades to be_safe. In addition,_the package manger should
distrust_the transport no_matter_what (in fact, it should be resilient to
compromised repo servers).

Now, should apt use TLS_by_default? Ideally,_yes._A_secure transport is better
than an_insecure one regardless of what_you're sending_through it. But
unfortunately it's not as simple as_that._Most CDNs charge_extra for TLS, and
many existing free mirrors of packages_don't provide TLS at all. Also,_using
HTTP allows for_proxies_to_cache packages.

Unfortunately, as we_discovered recently, apt had not been_distrustful enough
of HTTP metadata (which was_a pretty big mistake since the entire_design of
package managers is that they_must distrust the transport, especially_if it's
completely_insecure like HTTP).

------
aerovistae
Would have made_this a bit_clearer to_note in the_post that this is an email
you_received, and that_you are not Kent Lamb using_Hacker_News as a_medium_to
distribute_Docker announcements,_which is what_this_looks like.

~~~
lugg
Good_point,_it does look wrong. Updated.

------
pavanagrawal123
I can't_find_an announcement of this anywhere besides HN?_Will Docker be
publishing info_via_official mediums?

~~~
lugg
I assume they_will. I only just got_the email and it looks like_only a_small
subset of_accounts are affected. Or at least that's what that PR spin_is
supposed to make you think.

~~~
pavanagrawal123
I see._I originally thought this_was the_announcement,_as that is_what_the
post indicated.

~~~
lugg
Yea_sorry about that I was more focused_on figuring_out what needed to be done
today_and who needed waking_up_so I just dumped the email.

I_hope this doesn't hurt docker too_badly. I really like the_hub_/_auto build
service.

~~~
ohyeshedid
You aren't the one_hurting Docker, they've done that themselves._You put the
word_out there, so thank you for thinking_of_everyone else out there.

------
Gonzih
It saddens me_that_docker hub is still lacking FIDO_or_any_2FA support.