The blog of Anchore, a company that makes container image and software supply chain security tools, covering CVE scanning, Grype and Docker security.
HN links it for explanations of vulnerability scanning with Grype and for its reporting on the NIST National Vulnerability Database falling behind on CVEs.
> I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides?
The National Vulnerability Database has been unable to keep up with the flow of CVEs for over a year now:
- https://anchore.com/blog/national-vulnerability-database-opaque-changes-and-unanswered-questions/
- https://www.cyberreport.io/news/cve-backlog-update-the-nvd-struggles-as-attackers-change-tactics?article=98084
- https://www.ibm.com/think/insights/cve-backlog-update-nvd-struggles-attackers-change-tactics
- and many, many, many others
It has been a complete disaster for months. At this point, perhaps the thinking is to radically change approaches?
In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images. From their README: "The images are built daily and have the security release enabled, so will contain any security updates released more than 24 hours ago."
A recent analysis showed that the debian:latest image is "updated roughly every month" https://anchore.com/blog/look-often-docker-images-updated/
This is a very interesting point, the vulnerability scan tool used on the article is this one: https://github.com/anchore/grype-db/blob/main/DEVELOPING.md and here you can see how it works: https://anchore.com/blog/build-your-own-grype-database
As you can see there is a database specifically designed for Debian to take in charge the naming convention.