517
Rybbit - Open source Google Analytics replacement (lemmy.world)
submitted 11 months ago by to c/selfhosted@lemmy.world
82 comments fedilink hide all child comments
 

Hi guys, I've been working on a self-hostable web analytics platform since the start of this year after being frustrated with Google Analytics and Plausible.

I've packed a bunch of cool web analytics features into Rybbit, but I've tried very hard to keep the interface simple to use,

https://github.com/rybbit-io/rybbit

Check it out!

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 11 months ago* (last edited 11 months ago) (9 children)

You can verify the checksum to ensure the contents pulled are exactly the same as what was published. You can also use a private container registry.

How exactly would docker pull be any more insecure than something like pip install? Or, really anything… Let’s go with your preferred alternative, how are you going to get it on your machine in a more secure way than docker provides?

Docker uses TLS with registries, layers and manifests have cryptographic digests, checksums, and you can verify the publisher yourself. Push it into your own registry if you want, or just don’t use latest.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] -1 points 11 months ago* (last edited 11 months ago) (8 children)

    Yeah, that's the insecurity I'm talking about.

    If you want to know how to implement this properly, look at apt. Its a known issue in docker; they just haven't prioritized the fix yet (DCT)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 3 points 11 months ago* (last edited 11 months ago) (7 children)

    What are you talking about, “yeah that’s the insecurity I’m talking about.”

    I didn’t mention an insecurity and neither have you. Would you mind being a little more clear than “Docker pull is insecure?”

    Frankly, I was expressing confidence in dockers security. It goes without saying though, any user can do insecure things like download from untrusted sources. That’s not dockers problem though, it’s the users.

    Edit: I see now that you added “it’s the download that’s not verified.” Integrity is verified, so I assume you mean authorship (via signing)? I guess you’re saying that, if admin credentials are stolen from a container publisher and the thief force pushes malicious code into the registry under a pre-existing tag—then you would be exposed to that?

    Even in that case, though, a digest cannot be overwritten. Tags can. So you’d just pin the digest to avoid this one attack vector?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] -1 points 11 months ago (6 children)

    Checksums are not for security. You need signatures. I'm not making claims that aren't clearly documented.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 11 months ago (5 children)

    You’re talking about authorship. Sure. But if you verify the container yourself as secure and pin the digest, what’s the issue?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 11 months ago* (4 children)

    What you just described cannot be done. You can't verify it, because its not signed.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 11 months ago* (2 children)

    You’re making big claims on security here, like “cannot be done,” and each time you do I feel like we’re talking past each other a bit. I never claimed you can verify that the person who pushed the container had access to a private key file. I claimed you can verify the security of a container, specifically by auditing it and reviewing the publisher’s online presence. Best practices. Don’t upgrade right away, and pin digests to those which can be trusted.

    When you pin a digest, you’re not going to get a container some malicious agent force pushed after the fact. You pinned the download to an immutable digest, so hot-swapping the container is out the window. What, as I understand, you’re concerned with is the scenario that a malicious actor (1) compromised the registry login beforehand, (2) you pinned the digest after hand, and (3) the attack is unnoticed by you and everyone else.

    I’m trying to figure out under what conditions this would actually occur, and thus justifies the claim that docker pull is insecure. In a work setting, I only see this being an issue if the process to test/upgrade existing ones is already an insecure process. Can you help me understand why I should believe that, even with best practices in place, Dockers own insecurities are unacceptable? Docker is used everywhere and I’m reluctant to believe everyone just doesn’t care about an unmanageable attack vector.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago (1 child)

    Dude, just search the github for "docker content trust" and you can read all the issues. I'm not making big claims that aren't known already by the devs

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 11 months ago*

    Again we’re talking past each other. I’m sure those results are available and I’m aware docker doesn’t verify signatures automatically, but I’m asking how that necessarily makes docker insecure in spite of best practices being implemented. It’s about pinning yourself to trusted digests and having a verification process (like time) before updates. Why would you need authorship verification in that case? If there’s a good answer to that, I’d consider alternatives too. I’m just saying I don’t think it’s inherently insecure over this, and at face value It boils back down to the classic: don’t download untrusted software.

  • permalink
  • fedilink
  • source
  • parent