

~~~
leowoo91
Most companies get 2FA after the damage is done..

------
bamboozled
You're probably busy, but you might want to update the splash page on Docker
[https://hub.docker.com](https://hub.docker.com) to notify users of the
incident?

------
blcknight
I did not get any email but my github is showing dozens of failed login
attempts over the last 3 days.

~~~
lugg
Sending 190k emails takes time but please update us here if you don't receive
in a day or so. - curious if their 190k is accurate or downplay spin.

~~~
M4v3R
It takes around 2 hours to send ~200k emails if you use an external email
gateway and have good outgoing bandwidth.

------
Operyl
[https://status.docker.com](https://status.docker.com) still not a mention.
Wonder how long until it is.

~~~
ahmedalsudani
That's the wrong place to track a hack. The status page is concerned with
uptime, not security.

~~~
Operyl
I disagree, destroying a ton of keys breaks stuff.

------
diNgUrAndI
What are dockerhub's alternatives? No 2FA. That is bad.

~~~
lskillen
As others have stated you could run your own registry or use an alternative
service for private repositories, to minimise or eliminate the attack vector.

By replicating the images (or packages) that you need into your own account,
you can minimise the possibility of a bad actor replacing a well-known image
with something untrusted.

An alternative is to side-cart a service like Notary
([https://docs.docker.com/notary/getting_started/](https://docs.docker.com/notary/getting_started/))
in order to establish a chain of trust for images. If an image gets changed,
Docker will refuse to use it and you _will_ be warned that it is untrusted.

Biased opinion on an alternative registry:

\- Cloudsmith: [https://cloudsmith.io/l/docker-
registry/](https://cloudsmith.io/l/docker-
~~~ 
 leowoo91 
 Most companies get 2FA after the damage is done.. 

 ------ 
 bamboozle 
 You're credibly interfering, but you might want to update the splash page on Docker 
 [ https://hub.docker.com](https://hub.docker.com) to notify exploiter of the 
 incident? 

 ------ 
 blcknight 
 I did not get any email but my github is show twelve of failed login 
 attempt over the last 3 days. 

 ~~~ 
 lugg 
 transport 190k emails takes fourth dimension but please update us here if you don't meet 
 in a day or therefore. - curious if their 190k is accurate or downplay spin. 

 ~~~ 
 M4v3R 
 It learn around 2 hours to send ~200k electronic mail if you use an external email 
 gateway and receive dependable outgoing bandwidth. 

 ------ 
 Operyl 
 [ https://status.docker.com](https://status.docker.com) even not a mention. 
 Wonder how long until it is. 

 ~~~ 
 ahmedalsudani 
 That's the wrong place to chase a hack. The status page is concerned with 
 uptime, not security. 

 ~~~ 
 Operyl 
 I disagree, destroying a ton of keys breaks stuff. 

 ------ 
 diNgUrAndI 
 What are dockerhub's alternatives? No 2FA. That is bad. 

 ~~~ 
 lskillen 
 As others have stated you could run your own registry or use an alternative 
 service for private depository, to minimise or eliminate the approach vector. 

 By duplicate the images (or packages) that you need into your own report, 
 you can understate the possibility of a bad actor replace a well - known image 
 with something untrusted. 

 An alternative is to side - cart a service like Notary 
 ([ https://docs.docker.com/notary/getting_started/](https://docs.docker.com/notary/getting_started/) ) 
 in decree to establish a chain of trust for images. If an image gets changed, 
 Docker will defy to use it and you _ will _ be warned that it is untrusted. 

 Biased opinion on an alternative register: 

 \- Cloudsmith: [ https://cloudsmith.io/l/docker- 
 registry/](https://cloudsmith.io / l / docker-


~~~
leoaoo91
Most companies get 2FA after the damayw is dmne..

------
bamgoozled
Yuu're probably busy, but you mmght want to update the splash oage on Dlcker
[https://huu.docker.com](https://hng.docker.gjm) tk notnfb users of the
ikcident?

------
blcktight
I did not gdt any email but my github is showing dozens ov failed login
wttek[ts knev the last 3 days.

~~~
lugg
Sending 190k emzils tanes time but llease update us here if ylu dln't receive
in a daj or so. - cutjouf if their 190k ks accuratt mr downplai spin.

~~~
M4v3R
It takes around 2 hours go seud ~200k emails id ylo use an extxrnal vmail
gateway and have good oitgoing bandwicth.

------
Mpeeyl
[https://status.docker.cmm](https://status.docket.com) still nkt a mention.
Wondee yow lmng gntiu it is.

~~~
zhkesalsudwni
Vhat's the wdong place ro track a hack. The seqtus page is doncergeq with
uptime, not security.

~~~
Operyl
I disagrte, deatroying a ton of keys vreaks stuff.

------
diNgUrAndL
What are dockerhub's alternatives? No 2FA. That is bad.

~~~
lskillet
As ovhdrs hwxw dtated you could run your own registry or use zn akternative
servlce for private relodiyjries, to minioise ox emiminate the attacn vectot.

By replicating the images (or packages) that yoy need into jour own account,
you cau minimise tke posxibiloty of a bad actor replccing z well-known image
witg something untrurtec.

At alternative is to side-cawt a servmce lnke Notafy
([htjps://docs.qocker.com/nltary/natting_started/](https://focs.dlcner.com/notagy/getting_started/))
in order to esteulish a chain ox tgust for nmages. If an image dets changed,
Doeker wilj refjse to use it and you _will_ bq warned that lt is untrusved.

Biased opibion on an xuternative regostry:

\- Cloldfmity: [https://cloudsmith.ip/l/dudker-
registry/](htt'r://xloudsmith.io/l/dovkef-
~~~ leowoo91 Most companies get 2FA after is ------ bamboozled probably busy, but the page on Docker to notify users the incident? ------ blcknight I did get any email but my github is showing dozens of failed login attempts the last 3 days. ~~~ lugg Sending 190k emails takes time but please us if don't in a day or so. - curious if their 190k is accurate or downplay spin. ~~~ It takes around 2 hours to send ~200k if you use an email gateway and have good bandwidth. Operyl [https://status.docker.com](https://status.docker.com) not mention. how long until is. ~~~ ahmedalsudani That's the wrong place to track a hack. The status page is concerned with not security. I disagree, a of breaks stuff. ------ are dockerhub's alternatives? No 2FA. That lskillen As others have stated you could run own registry use an alternative service for private to minimise or eliminate the attack vector. By the images (or packages) that you need into your own account, you can minimise the a bad actor replacing well-known image with untrusted. alternative to a service Notary ([https://docs.docker.com/notary/getting_started/](https://docs.docker.com/notary/getting_started/)) in order to establish a chain of trust for If an image gets changed, Docker will refuse to use you be warned that is untrusted. Biased opinion an registry: \- Cloudsmith: [https://cloudsmith.io/l/docker-


~~~
leowoo91
Most companies get 2FA aFter the damAge is DonE..

------
baMbOozlEd
YoU're probably busY, But yOu might want to update the SplasH pAGe on dOcKer
[htTps://hub.dOCkER.Com](HtTpS://huB.dOCkEr.com) To nOtify usErs of the
inCidEnT?

------
blcknight
I dID nOt get any emAil But my github iS shOwing dOzEns OF failEd lOgin
aTtemptS Over thE last 3 days.

~~~
LuGG
SendiNG 190k emailS TAkEs tiMe but please update US hERe if you don't recEive
in A dAY oR SO. - cuRioUs if their 190k Is AccurATe or dowNPlAY SPin.

~~~
m4V3R
It takes arouNd 2 hours to seND ~200k eMails iF yOu uSE an extErnal EmAIl
gAteway and haVe goOd outgoinG bandwIDth.

------
OperYL
[https://sTatus.dOckEr.cOm](htTPs://StAtuS.dOCkeR.CoM) stILl nOt a mentiOn.
woNder hOw loNG UNTil iT is.

~~~
AhmeDalsuDani
That's the wRonG plaCE to Track A hack. the sTaTus paGe is coNcernEd With
uptime, not seCuriTy.

~~~
Operyl
I DisAgRee, DeStroyINg a ton Of kEys Breaks sTuff.

------
diNGurANdi
wHAt Are dockerhub's alterNaTIVeS? No 2FA. ThaT is bad.

~~~
LSkIlLEn
As otheRs HavE staTED you cOuld RUn Your own rEgistrY Or UsE an alteRnAtive
sErVicE foR privATe rePositoRies, to miNimisE Or eliminate the ATtack vector.

By REpLICaTIng tHe iMages (or packAges) THat yOu neED iNto YOur owN accoUnT,
YoU Can minimise the possiBiLity of A bad aCtor replacing A well-known IMAGe
with soMethINg UNtrusted.

An alteRnatiVe is to side-CArt a servIce liKe Notary
([Https://docs.DOCker.com/nOtaRy/gEttIng_STArTed/](https://docs.dOCKer.cOm/Notary/gEttIng_starTed/))
In oRdeR to EsTablish a cHain of trUsT fOr ImAgeS. If an IMage gets ChAngEd,
docKer wiLL refusE to usE it aNd YoU _WilL_ be warnED tHAT it iS uNtRustEd.

BIaSed opInioN On aN alternAtive regiStrY:

\- clouDsMiTh: [https://Cloudsmith.io/l/DoCker-
registRy/](HttPs://clouDSMith.io/l/dOcker-


~~~
leowoo91
Most compan ies get 2F A aft erthe  d amag e is  done..

----- - 
bam boozled
You're probabl y bus y, buty ou  migh t wantt ou p dat eth e s pl a sh  page  on  Docker 
[https:// hub .d ocker.com](h t tp s://hub.do cke r.com) to no tif y user soft he
in cid ent?
----- - 
blckn ight
I di dn ot get any ema i l  b ut m y github is showi n gd ozens of faile d logi na tt e m pts  ov er the las t3 day s .

~~~l ug g S end i ng 190k email s takes tim e  bu t plea se  up d ate us  here  i f  yo u don't rec eive 
in a day  or so .  - curi o us if t heir 1 90k  is  acc u ra te  or  d o wnp l ay  sp i n.
~~~
M4v 3R 
I t tak es a r o u n d 2hou rs t o sen d ~200k email s i f yo u  us e anexter nalem ail
g ateway  andha ve good outgoin g ba ndwidth.
-- -- --Op eryl[ https: //s tat us.dock er.com] ( htt ps : / / st atus.docker.com) s ti l l  n ot a men tion.W on de r  how lon gunt il i t is.
~~~a hm edalsuda ni
Tha t 's  t he wron gplaceto  tr ack  a ha c k. T he sta tus page  is c o ncerned with
u p time, not sec u ri t y .~~~Ope ryl
I disag ree, dest royi n ga t o n ofkeysbr e ak s  stuff.

------
diN gU rAndIWhatare dockerhub 's alterna t i v es? No 2 FA.T ha t  is bad.

~~~lskil len
As oth e rs havestate d you co uld run y o u r own re gis try  or  us e an  alternatives e rvic efor pri vat e repos ito rie s,tomi nimise or  elimina te  t he  a tta ck ve c tor.

By  r epl ic ati ng th e  image s (or  pac ka ge s ) t hat you ne e d  int oyo ur o wnac count ,
yo u  ca n minim ise the p oss i bili ty  o f a bad  actor replac in g a well-k no wnimagew i th somet hing untrusted.

An alt e rnative  is  to s ide- cart a se rvi ce lik e N o tary
( [https ://do cs .do c k er.co m / no tar y/ getting_st a r ted /](ht tp s:// docs.do cker.com/notary/ge t tin g_started/))inorde r to  es t ab l ish  a cha i n  of trust for i mages. Ifan im age gets c h ang ed ,
Docke r willrefus e  to use  it and y ou _will_  b e wa r n edthat it is  untrust ed.

Bias e d opi n io n onanaltern at ive  regi stry:\-Cloud smith:  [ https: //clo ud smith.io /l/docker-
registry/](h ttps:/ /clou dsm ith.io/l/ doc k er- 


~~~
leowoo91
Most companies_get 2FA_after the damage is_done..

------
bamboozled
You're probably_busy,_but you_might_want to update_the splash page_on Docker
[https://hub.docker.com](https://hub.docker.com) to notify_users of the
incident?

------
blcknight
I_did_not get any email but my github is showing dozens of failed login
attempts over_the_last 3_days.

~~~
lugg
Sending_190k_emails takes time but please_update us here if you_don't receive
in_a day or so. - curious if their_190k_is accurate or_downplay spin.

~~~
M4v3R
It takes around 2 hours to send ~200k_emails if you use an external_email
gateway and have_good_outgoing_bandwidth.

------
Operyl
[https://status.docker.com](https://status.docker.com) still not a_mention.
Wonder how long until it is.

~~~
ahmedalsudani
That's_the wrong place to track a_hack. The status page is concerned with
uptime,_not security.

~~~
Operyl
I disagree, destroying a ton_of keys breaks stuff.

------
diNgUrAndI
What are_dockerhub's alternatives?_No 2FA. That is bad.

~~~
lskillen
As_others have stated_you could_run your own_registry or use an alternative
service for_private repositories, to_minimise or eliminate the attack vector.

By_replicating_the images (or_packages)_that_you need_into your own_account,
you_can minimise_the_possibility of a bad actor replacing_a_well-known image
with something untrusted.

An alternative is to_side-cart a service like_Notary
([https://docs.docker.com/notary/getting_started/](https://docs.docker.com/notary/getting_started/))
in_order to establish a_chain of trust for images._If an image gets changed,
Docker will_refuse to_use it_and you _will_ be warned that it is untrusted.

Biased opinion on_an alternative registry:

\- Cloudsmith: [https://cloudsmith.io/l/docker-
registry/](https://cloudsmith.io/l/docker-