Comment by vanschelven
6 hours ago
Python users may need to take their own separate steps, see this discussion:
https://discuss.python.org/t/information-for-python-users-re...
6 hours ago
Python users may need to take their own separate steps, see this discussion:
https://discuss.python.org/t/information-for-python-users-re...
This is such a clusterfuck. I use so many containers in my home lab and various local installations and stuff. Honestly, I have no idea what I'm even supposed to do at this point because I'm not a full time developer.
Well, that is what people who have been around the block a few times have been saying about containers since just about forever. "I don't want to be an admin for my n software packages, I'll use containers!" - now you are the admin of n containers, except with worse tools than your distro and no upstream support.
And since before that, when we started turning to additional packages managers installed with package managers. Pip etc. mean that an “apt upgrade” isn’t enough, when it really “should” be (used to be) in a well managed system.
Then we layered _another_ level of package management on top with Flatpak etc.
I don’t think anyone has _really_ been - in practice - able to understand how many versions of Python (or shells or ruby or Perl etc…) are installed on any system for a decade or two now.
[Edit to add: and I forgot entirely about venvs (and other language’s equivalents). We put package managers into packages! Now there can be a different version of every package for every script on your system. In every container. And Python even has more than one venv system to choose from!]
[Yes, I use all these things - it’s so hard _not_ to and still use modern software or participate in modern software development…]
3 replies →
I use some rules and a few generated scripts and have a LLM handle the management of the containers. Security through a ssh gateway, allows them to deploy/remove containers and then the rule is to stay at least two weeks behind on releases, unless the latest release is security related, which it figures out by reading the release notes.
I ran watchtowerr before, but I think this is a smarter way to do it.
One could say comeuppance is a dish best served cold. So cold people don’t even know it’s been served. All the old sys admins remember!
For me, this comment actually bolsters the argument for containers imo. It's a lot easier to rebuild a system image and redeploy it out across a bunch of apps than it is to update a bunch of VMs (maybe ansible/puppet makes it moot). Idk
Examples of what you can do:
* Take the containers offline for the time being until you know what to do
* If it's important for your that they keep running, still take them offline and put them in a VPN this weekend
* Use renovate in the future to automatically update your containers
Python environment was so brittle, that a solution was found: pack dependencies into "envs" of various kinds. Disk space is cheap, after all (ahem). Now it's time to pay the bill for that approach...
don't worry. if you're in this situation with this attitude, you're likely running out of date container base images and whatnot.
i highly suggest you forget about containers, learn about systemd unit file hardening, and then you only have to play sysadmin to your base os and the binary for the program you want to run.
"Hey claude this is the cve I need you to fix [link]"
Takes about 20 seconds. Depending if you need to hit enter.
cool cool cool. Don't understand what you're doing, and keep not understanding what you're doing. the agents are infallible after all, and who cares about properly verifying certs anyway? that's nerd shit.
3 replies →
Yeah, at some point I gave up and asked AI to do patching for me. It was a good call because it found affected certificates in places where I wouldn't look (e.g. aws-cli or Libre Office).
uv should be your friend.
uv defaults to its own trust store afaik lol
1 reply →
Welcome to corporate
> Failure to do so could result in monster-in-the-middle (MITM) attacks against TLS clients, including python.org and pypi.org .
Monster?
Gender-neutral variant of man-in-the-middle. They should have just used something less controversial like master-in-the-middle.
"master" is less controversial?
2 replies →
To be fair, a monster is scary so it fits. Malice in the middle perhaps would have been less confusing.
> Gender-neutral variant of man-in-the-middle
Countless and countless, no, millions of male developers felt discriminated against whenever someone called it Man-in-the-middle. This went on unaccounted for for decades! Finally we’re being seen!
Not to mention all the women who were misogynisticly attacked by assuming women can’t be hackers.
Finally justice. It’s very important that we’re getting our priorities right when talking about security vulnerabilities!
3 replies →
Monkey-in-the-middle would've worked since someone could monkey with your packets and it's already an established name for a children's game
1 reply →
I prefer the chaotic option of MITM-in-the-middle.
(Mallory-in-the-middle is OK too.)
Or, you know, man-in-the-middle because that was already a correct, perfectly clear use of English.
The women developers would like to cede this gender-neutral replacement back to the men, we don't want to be included.
/s
I absolutely love monster-in-the-middle. Big round of applause to whoever thought of that.