RadiozRadioz
Joined 7 years ago
Joined 7 years ago
Typically I am installing images from large, established projects whose release practices I can trust to not re-use an old version tag and slip in a breaking change. It's technically possible, but why would they do that? Unless they've been hijacked, then it becomes about security posture which I see as a separate discussion to this one about breaking changes.
Someone like the author, or maybe yourself, may not trust their software repository and want a hash like Nix's lockfile, which is totally fine. My point is that you can do that just fine with container images, so the author's statement is not the complete picture.
Then you should write down the exact image you downloaded. Images are tagged and hashed, you're guaranteed to download the same thing again if you ask for it.
I always explicitly request a version tag for every container image I configure in my system. If I want to upgrade, it's obvious what I'm going from and to, so I can check the changelog for breaking changes.
Are people seriously running :latest everywhere? No wonder the author thinks it's not stable.
Fundamentally, there is a big sect of the JavaScript ecosystem / culture that is hype-driven and has extreme churn. Jumping to every new framework and runtime without thought for the long-term, or any regard for historical patterns.
This stuff keeps happening. Somehow I'd love to get through to the perpetuators of the JS hype treadmill that they're only hurting themselves and making themselves look foolish when the churn inevitably hurts them and the wider ecosystem.
But maybe they jumped to the next shiny thing after Deno before Demo's demise was announced, and they'll learn nothing.
It's definitely worthwhile to point out that LLMs have changed the economics of looking; we can now look in far more places far more quickly than we could before. But the above points were that the vulnerability itself happened to be an easy one that didn't intrinsically require an LLM.
They are not overwhelming, mind you, but I did notice them immediately. They stood out enough that I wondered what they were and started researching, that alone says something about the prevalence.
Edit: An LLM tells me that this is partly unique to how far South Australia is and the positioning of the sun in Australia's Summer. But I lack the physics knowledge to confirm that.