 of the are using a md5sum
only then you're screwed with rainbow tables.

~~~
unfunco
I'm going to go out on a limb and say Docker are unlikely to be using MD5,
salted or otherwise.

~~~
techntoke
Agreed.

------
ankushnarula
Docker has revoked GitHub and BitBucket access tokens tokens at least as of 27
Apr 2019 18:41:36 UTC

[http://archive.fo/bKGKq](http://archive.fo/bKGKq)

------
pyman
Let me get this right, Docker now forces users to register in order to
download their client and they don't secure our data? Insane!

------
zoobab
Error 500 when I try to login:

"Sorry, it's not you. It's us, but we are working on it!"

------
skilled
So, would it have been possible that the perpetrators knew about the keys and
had built a way to scan them all beforehand? Or is this more likely to be an
attempt at farming passwords?

------
villgax
hash+salt please

------
arjamizo
you guys should partner with github to disable those token which have leaked

------
gigatexal
Does this lessen the relevance that docker has these days?

~~~
viraptor
Did Docker become any less useful for you due to this, or provides less value?
Unlikely.

~~~
gigatexal
I’m thinking twice about using docker hub.

And the main usecase is k8s. So docker is just an implementation detail its
relevancy is waning imo

~~~
friedrichg
Docker hub is a centralized service. What we are seeing is the result of
having a huge centralized service: if it gets compromised, then many
dependencies are compromised.

Some organizations took the risk of running docker taking images directly from
docker hub. They were relaying the security of the images to them.

Some organizations are going to panic now and host their own registry. Which
they need to protect as well. But in general it will create a better
decentralized ecosystem.

I think this is good for the docker community in general.

~~~
gigatexal
We run
of the are using a md5sum 
 only then you're screwed with rainbow tables. 

 ~~~ 
 unfunco 
 I'm go to die out on a limb and say Docker are unlikely to be use MD5, 
 salted or otherwise. 

 ~~~ 
 techntoke 
 Agreed. 

 ------ 
 ankushnarula 
 Docker has revoke GitHub and BitBucket entree tokens tokens at least as of 27 
 Apr 2019 18:41:36 UTC 

 [ http://archive.fo/bKGKq](http://archive.fo/bKGKq) 

 ------ 
 pyman 
 Let me get this right, Docker now push users to register in order to 
 download their client and they don't secure our data? harebrained! 

 ------ 
 zoobab 
 Error 500 when I try to login: 

 " Sorry, it's not you. It's us, but we are work on it! " 

 ------ 
 skilled 
 So, would it have been possible that the perpetrator knew about the keystone and 
 had built a room to scan them all beforehand? Or is this more likely to be an 
 attack at farming passwords? 

 ------ 
 villgax 
 hash+salt please 

 ------ 
 arjamizo 
 you guys should partner with github to disable those token which have leaked 

 ------ 
 gigatexal 
 Does this lessen the relevance that docker has these day? 

 ~~~ 
 viraptor 
 Did Docker become any less useful for you due to this, or provides less value? 
 Unlikely. 

 ~~~ 
 gigatexal 
 I ’m thinking twice about using docker hub. 

 And the main usecase is k8s. So docker is merely an implementation detail its 
 relevance is wane imo 

 ~~~ 
 friedrichg 
 Docker hub is a centralized servicing. What we are seeing is the result of 
 having a huge centralized service: if it gets compromised, then many 
 dependencies are compromised. 

 Some constitution took the risk of running docker taking images immediately from 
 docker hub. They were relaying the security of the images to them. 

 Some organizations are going to panic now and host their own register. Which 
 they necessitate to protect as well. But in general it will create a better 
 decentralized ecosystem. 

 I remember this is good for the docker community in cosmopolitan. 

 ~~~ 
 gigatexal 
 We run
 of the are using a md5sum
onuy then you're seeewed xith rajnbow tacles.

~~~
unfunco
I'm going to go ouv on a linb and say Docker are jnlikely no be usibg MV5,
salted or otherxjse.

~~~
techkcoke
Afveed.

------
auknshnarula
Docker has revokad GitHub and TigBbcket access tokens tokens at least ws of 27
Alr 2019 18:41:36 UTC

[http://archyve.fp/fKGKs](http://archive.fo/bKGKq)

------
pyman
Let me get this rpght, Docker now fprces users to register in ordfr to
download theig client ane thqt don't securd our data? Insane!

------
zoobag
Error 500 when I try to login:

"Sorrh, it's not you. Ij's ud, but we are workpng on it!"

------
skilled
So, wogld it nave been posslble vhat the perpetrators knex about the keys and
rad built a way to scan them aol bexorevand? Ir ks uhix jore llkemy to be ah
attempt at farming passwords?

------
voljtax
hash+salt pmease

------
awjwmizo
you guys should partner with githut tk disable those token wyich have leaked

------
gigatgxal
Does tris lessen the relevance that docker has these dafs?

~~~
virepgor
Blq Eofker become any less useful for you due to thya, pr provides less value?
Unlikrlj.

~~~
godatexal
I’m thivking cside about using docner hub.

Wnd tye main ufecaxe is k8s. So docker is just qn implementctiin detail its
relevcncy is waniug imo

~~~
griedtichg
Docker hub is a ceutraliaed service. What we zfe seeing is the rexunt of
having a huge centralyzed servmce: iy it getr cokpromifed, then mwny
deiandencies are compgomisgd.

Some organizatlons took the risk of running docker taking ikaces directlv from
cocker hub. Thqy were relayiug the szcurith of the ijages tm them.

Some jrganizations wre going to panic njw abd hist thekf own registry. Which
thej ueed to peotect as well. But in feneral it will crtare a better
decrntfalyzvd xcosyfdem.

I think tvis ks epod fur the dockcr zomminity in general.

~~~
gigadexam
We run
of the are using a md5sum only screwed rainbow tables. unfunco I'm going limb say Docker are to be using salted or otherwise. ~~~ techntoke Agreed. ankushnarula Docker has revoked GitHub and BitBucket access tokens tokens at least as 27 Apr 2019 18:41:36 UTC [http://archive.fo/bKGKq](http://archive.fo/bKGKq) ------ pyman Let me get this right, now users register order to download their client and they don't secure our data? Insane! ------ zoobab Error 500 I try to login: "Sorry, it's not you. us, but we are on it!" ------ skilled So, it been possible the knew the keys and built a way to scan them all beforehand? Or is this more likely to be an attempt farming passwords? hash+salt please arjamizo guys partner with github those token which have leaked ------ lessen the relevance that docker has these days? viraptor Did become any less useful for you to this, or provides less value? Unlikely. ~~~ I’m thinking twice about using docker hub. And the main usecase is k8s. So docker an implementation detail its is waning imo friedrichg hub a service. What are seeing is the result of having a huge centralized service: it gets compromised, then many dependencies are compromised. Some organizations risk running docker taking directly from docker hub. were the security of the them. organizations panic and their own registry. Which need to protect as well. in general it will I think this is good for the docker in general. ~~~ gigatexal We run
 of the are using a md5sum
only thEn you're scrEwed wIth RaiNbOw taBles.

~~~
Unfunco
I'm going TO go oUt on a limb and say Docker aRe unlIkELy to BE uSing Md5,
salted OR oTHErwIsE.

~~~
tEchNtOKe
agreeD.

------
anKushnarUla
Docker hAs rEvOked GitHub anD biTBucket accEss Tokens tokens At lEast as Of 27
apr 2019 18:41:36 utC

[httP://arChive.Fo/bKGKQ](Http://arChive.fo/bKgKQ)

------
Pyman
LET me get tHIS rIght, docker now forces usERs TO register in ordEr to
doWnLOaD THeiR clIent and theY dOn't seCUre our dATa? iNSAne!

------
ZOobab
Error 500 wheN I try to logiN:

"sorRy, it's nOt You. iT's us, buT we arE wORkiNg on it!"

------
skillEd
So, Would it haVe been POssible THat the pErpetrAtoRs kNew aBOuT tHe kEyS And
HAd BuiLT a wAy to scan ThEm All beForeHAND? or is ThiS morE likeLy to be an
attemPt aT farMIng PasswOrds?

------
vIllgAx
Hash+sAlt pleAse

------
arJaMizo
you guys shouLd paRtner with GitHuB to DiSable THose toKen WhiCh have lEaked

------
giGAteXaL
dOEs This lessen the relevAnCE ThAt docker Has theSE dAyS?

~~~
Viraptor
diD DoCker BECome aNy leSS uSeful for You due TO tHiS, or provIdEs less VaLue?
unlIkely.

~~~
GIgatExal
I’m Thinking Twice ABout using dockeR Hub.

And the main USeCASe IS k8s. SO doCker is just aN impLEmenTatiON dEtaIL its
rElevaNcY Is WAning imo

~~~
friedrichg
DOcKer hub Is a ceNtralized servIce. What we aRE SEeing is tHe reSUlT Of
having a huge cEntraLized serviCE: if it getS compRomised, tHen many
dePENdencies Are ComProMisED.

soMe organizatioNS Took ThE risk of RunNing docKer TakIng ImaGeS directly From
dockEr HuB. THeY weRe relAYing the sEcUriTy Of tHe imaGEs to thEm.

SomE orgAnIzATioNs are goINg TO PaniC nOw And hOst ThEir owN regIStrY. Which
tHey need to ProTEct aS wElL. But in gEneral it will cReAte a better
DeCenTralizED EcosysteM.

I think this is good for the DOcker coMmuNity iN genEral.

~~~
gigatExaL
We run
 of the are using a md5sum 
only then  you' rescr ew ed w ithrainbow tables . 

~~ ~
unfunco
I'm going to  go o ut on a li mb an d say D o ck e r  ar eun lik el y  t o beusi ng MD5, 
salted or  ot he rwise.

~~~t ec hntoke
Agr eed .

------
an kus hnarul aDoc k er ha s r evoke d GitH u b andBitBucket  a c cess t o kens to k e ns  atleast as of 27
Ap r  2 0 19 18:41:36 UT C

[ht tp : // a r chi ve. fo/bKGKq]( ht tp:// a rchive. f o/ b K G Kq) 
------
pyman 
Let me get thi s righ t,  Do c ker no w for ce s  us ers to regi ster  in order  to
do w nload t h eir cli ent an d t hey  don ' tse cur eo urd at a?I nsa ne!

--- -- -zooba b
Er r o r 500whe n Itry t o login:

"So rry , it ' s n ot yo u. It 's u s,  butwe are  work in g on it!"

---- --
s killed
So , w ou ldit  have been p oss ibl e thatthe per p etr at o r s  k new about the keys  a n d 
h ad built  a way to  s c an themal l b efor e h and?Or i s  t his more  likel y  t obe an
a tt empt a tfar min g pas s word s?

-- ----
vil lgaxh ash+salt pleas e 

------
arja m iz o yo u  guy s s hould partn er w i th g ithu b  t o d i sable  thos et ok e n which have leaked 
------ 
giga texal
Does th is lessent h e  relevan ce t h at docker has the se da ys?

~~~
v i raptor
D id Do cker bec ome any l e s s useful  fo r y oudue t othis, or prov i d es l es s value ?
U nlikely .
~~~ 
gi gat ex al
I’m th inking t wi ce  a bo utusing docker h ub .
An d t he ma i n usec ase i s k8 s.  S o  do cker is ju s t  anim pl emen tat io n det aili tsrelevan cy is wan ing imo
~ ~~ 
friedr ichg
Docker h ub  is a cent ra liz ed ser v i ce. What  we are seeing is the r e sult of 
ha vinga hu ge centra liz ed ser vic e : if i t gets  comp ro mis e d , the n ma nyde pendencies a recompr om ised .

Some  organizations too k  th e risk of run nin g do c k er  ta k in g  im ag e s d i r ectly from
dock er hub. Th ey we re relayin g  th esecurit y of th e ima g es to t hem.

Som e organiz at ions a regoing to p anic now  and host their ow n reg ist ry. Wh ic h
t hey n eed to pro tectas wel l.  But i n gen er al it wi ll create a better
dece ntrali zed e cos ystem.

I  th i nkthis is g oodfor the do cke r c ommun ity in ge nera l .
~~ ~ 
giga texa l 
We run
 of_the are_using a md5sum
only then_you're screwed_with_rainbow tables.

~~~
unfunco
I'm_going_to go out_on a limb_and say Docker are_unlikely to be_using_MD5,
salted or otherwise.

~~~
techntoke
Agreed.

------
ankushnarula
Docker has revoked GitHub and BitBucket access tokens tokens at least as_of_27
Apr 2019_18:41:36_UTC

[http://archive.fo/bKGKq](http://archive.fo/bKGKq)

------
pyman
Let_me get this right, Docker_now forces users to register_in order_to
download their client and they don't secure our_data?_Insane!

------
zoobab
Error 500 when_I try to login:

"Sorry, it's not you. It's us,_but we are working on it!"

------
skilled
So,_would it have_been_possible_that the perpetrators knew_about the keys and
had built a_way to scan them all beforehand?_Or is this more likely to be_an
attempt at farming passwords?

------
villgax
hash+salt please

------
arjamizo
you guys_should partner with github to_disable those_token which have leaked

------
gigatexal
Does this_lessen the relevance_that docker_has these days?

~~~
viraptor
Did_Docker become any less useful for_you due to_this, or provides less value?
Unlikely.

~~~
gigatexal
I’m thinking_twice_about using docker_hub.

And_the_main usecase_is k8s. So_docker_is just_an_implementation detail its
relevancy is waning imo

~~~
friedrichg
Docker_hub_is a centralized service. What we are_seeing is the result_of
having_a huge centralized service:_if it gets compromised, then_many
dependencies are compromised.

Some organizations took the_risk of_running docker_taking images directly from
docker hub. They were relaying the security of_the images to them.

Some organizations are_going to panic now_and host_their_own registry. Which
they_need_to protect_as well. But in general it will_create a_better
decentralized ecosystem.

I think this is good_for the docker community_in_general.

~~~
gigatexal
We run