• 0 Posts
  • 24 Comments
Joined 1 year ago
cake
Cake day: October 11th, 2023

help-circle





  • Yeah, containerization does make it much easier to just throw away the base system and start fresh. This way, you don’t have to worry about possibly straying the recommended upgrade path and accidentally breaking something.

    More code adds complexity, complexity leads to more bugs, more bugs means more vulnerabilities. Virtualization takes a lot of code. With all this extra code, it is possible that you are actually expanding the attack surface instead.

    It is likely inconsequential for most people just running a couple personal services at home, but organizations are pretty frequently targeted by sophisticated attacks, where the consequences of a breach can be severe.

    Yes, many of these vulnerabilities are difficult to exploit, either requiring local access or the existence of another vulnerability to achieve local access.

    However, there also exists a massive market segment whose entire business model relies on selling local access to VM compute resources, cloud server providers. An attacker could simply rent a VM on a vulnerable platform to gain the needed local access, launch an attack on the host and thereby compromise the other guests on the same machine.

    There have been an incredible number of flaws found and fixed (for now) in the isolation provided by virtual machines. VMware had a spat of critical vulnerabilities in 2024.


  • Yes, it matters.

    Also, the actual isolation of container environments varies greatly, on a per container basis. Containers are far less isolated than virtual machines, and virtual machines are less isolated than separate hosts.

    Neither containers or VMs will will protect from attacks on the host, see regreSSHion. You may be able to limit access to your host by using containers or VMs, but container escapes and VM escapes are not impossible.

    There is much time and effort required to maintain each of these layers. With “stable” distros like Debian, It is often the responsibility of the distribution to provide fixes for the packages they provide.

    Given Debian as the example, you are relying on the Debian package maintainer and Debian security team to address vulnerabilities by manually backporting security patches from the current software version to whatever ancient (stable) version of the package is in use, which can take much time and effort.

    While Debian has a large community, it may be unwise to use a “stable” distro with few resources for maintaining packages.

    OTOH, bleeding edge distros like Arch get many of their patches directly from the original author as a new version release, placing a lower burden on package maintainers. However, rolling releases can be more vulnerable to supply chain attacks like the XZ backdoor due to their frequent updates.










  • I think we still need more time/data to get the whole picture. EVs are still in their early stages.

    It would be interesting to look at fire rates for vehicles at rest. These types of fires have the potential to become quite serious, as they are often not immediately noticed, especially if the vehicle is parked in a garage or remote area. This additional time allows the fire to spread and intensify.

    Since EV fires are typically more intense than ICE vehicles, we should expect EV fires to cause more damage to the surroundings and to spread faster. Though, this danger could be offset if EVs have a lower probability of self ignition.

    We should also look at fires while refueling/charging. Lithium cells are most dangerous when charging and discharging. While an overfilled gas tank is easy to spot and may catch fire, a continually overcharged battery is invisible and will catch fire. Also, because of the long charge time of batteries, many EV owners leave the vehicle unattended while charging and would not immediately notice a fire if one were to occur. In addition, EVs are often charged at home, in close proximity to residences and other vehicles, and often within garages. These residential locations do not have the same fire safety requirements and suppression systems as gas stations, so a vehicle fire at home is already much more dangerous and has the potential to severely damage your home.

    We have had a century to figure out ICE, but it’s still very early days for EVs, so only time will tell.


  • LiPo batteries of the same capacity actually have the potential to be much more dangerous than the sodium cell shown here.

    LiPo packs typically use flat, soft walled cells which are far more susceptible to being punctured. In the event of a puncture or overcharge event, high temperature enduring flames are produced, with the severity and duration largely depending on the amount of energy within the cell. LiPo batteries also degrade at a much faster rate (both over time and with charge cycles) and have been known to spontaneously combust in storage while at rest.

    With the sodium battery, the thrust produced by the puncture could have been easily been overcome by properly securing the cell.