<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 07/20/2015 02:52 PM, Adam Miller
wrote:<br>
</div>
<blockquote class=" cite"
id="mid_CAA_4i2Ea81fHpat7D_DGME75unJh06nBtQMaJwwUi0gQR6ywDQ_mail_gmail_com"
cite="mid:CAA_4i2Ea81fHpat7D+DGME75unJh06nBtQMaJwwUi0gQR6ywDQ@mail.gmail.com"
type="cite">
<pre wrap="">On Mon, Jul 20, 2015 at 1:46 PM, Przemek Klosowski
<a class="moz-txt-link-rfc2396E" href="mailto:przemek.klosowski@nist.gov"><przemek.klosowski@nist.gov></a> wrote:
</pre>
<blockquote class=" cite" id="Cite_5724499" type="cite">
<pre wrap="">
Modern package-based systems like Fedora achieved a practical "patch early
and often" setup with responsive security posture, but they are subject to
creeping subsystem incompatibilities. Containers deliver integrated systems
that address very well the initial requirements, but I haven't seen a good
story on how they respond to dynamical security demands. So far their track
record is not so good ( "over 30% of official images in Docker Hub contain
high priority security vulnerabilities",
<a class="moz-txt-link-freetext" href="http://www.infoq.com/news/2015/05/Docker-Image-Vulnerabilities">http://www.infoq.com/news/2015/05/Docker-Image-Vulnerabilities</a> ).
</pre>
</blockquote>
<pre wrap="">
I'm mostly interested in the general consensus behind if we should
make an effort to ship previously EOL'd Fedora releases. If you were
aiming to make an argument for or against it then my apologies and I
would like to request clarification because I misunderstood and am
unsure if you were for or against.</pre>
</blockquote>
I think it is a bad idea because it essentially sanctions choosing
obsolete setups with unknown security and operational properties.<br>
I understand baking a container from fresh ingredients---yes, it'll
be subject to dynamic security decay, but at least it'll be good in
the beginning. <br>
<br>
In contrast, a containerized obsolete system should be basically
considered shot right from the moment it was created, and then it
will get worse as the time goes on.<br>
<br>
I think we should discourage this on principle.<br>
</body>
</html>