Well if you're uncomfortable with its priviged daemon, you can always switch to CRI-O with Red Hat tooling for it. But for all my years with Docker as the container runtime, all security related problems have occured within the backend code, not Docker, not Linux cgroups, not Linux itself.
I've worked with some big customers in the financial industry, and this is exactly what we do. Podman implements the same CLI as docker, so you can basically just `s/docker/podman/g` (as long as you don't use docker-compose).
It's also a lot easier to debug and see what's happening without that daemon sitting in the middle of all the traditional linux tools.
containers in general are horrible wrt security because they are architecturally flawed - they pretend to have some sort of 'isolation' but that was crap docker marketing people just made up - there is no isolation - k8s pushes this agenda further by declaring that multi-tenant workloads are perfectly normal and ok for containers which they absolutely are not
just look at the CVEs from recent years:
* docker doomsday
* escaping like a rkt
* cryptojacking? - that didn't even exist until containers were here!
Now every website you visit, any ad/tracker, any homecalling phone app can tell what movies and contents you watch and when you are at home. For years.
> Saving Netflix's bandwith costs by sacrificing your privacy.
> IPFS and bittorrent don't do anything to protect the data you are uploading and your IP address.
And Netflix are using it across AWS for distributing container images, not touching client devices, unless you know something more than what the article says.
This doesn't have anything to do with customer's privacy.
Do not visit this site. If you visit it once and then visit it after a while they will fill it with crap that you did not download in order to blackmail you or something I presume. Alternatively they might start tracking you only once you visit it. Even if they are honest it is extremely inaccurate (it had 8.8.8.8 torrenting anime a while ago for example)
Bogus results can simply be the result of ISP IP address recycling which, in my case, is pretty obvious. Besides, why would they wait on an IP address visit to fill it with blackmail material? The suspicion doesn't make much sense to me.
Circumventing censorship without strong anonymity is not necessarily pointless: you can publish something sensitive from a place where you'd not be prosecuted (e.g. from abroad). The point is to bring the message to those who are denied information.
It's x86, so if you count ME/PSP as a back door, then the answer is almost universally going to be yes. It would be like commenting on the new release of Ubuntu and asking if it was still using a Bourne-like shell by default.
- Smart tanked water heaters hold heat for many hours. Shut off during high load times. Nearly invisible to user in most cases.
- Space heating & cooling pre-heats or pre-cools before anticipated peak demand & shuts off during peak. E.g. Nest Rush Hour Rewards.
- Electric dryer waits to start until rates are low. Or could even interrupt briefly during a short spike. Clothes will not mind being damp another thirty or sixty minutes.
The user needs to be inconvenienced. Prioritizing convenience the way we do now is going to guarantee the we carry on right up until civilization collapses completely.
Same for the large majority of people in Europe up to the 1940s.
People would often "eat" meat only on Sundays by cooking a chunk in a soup. Then the elder in the family would eat the meat and everybody else would just taste it in the soup.
