5 ms·

Why should anyone trust this website and download the software? There's no indication who made it. Could be malware for all I know.

Squarex 3y ago
Looks like it's open source https://github.com/macOScontainers https://github.com/macOScontainers
- ThePowerOfFuet 3y ago
  Unfortunately, that doesn't answer their question.
  - RockRobotRock 3y ago
    It answers both of their questions. Git lets you see the author and they can audit the code if they like.
    - dangus 3y ago
      IMO that’s not good enough, especially when disabling SIP is involved. We don’t even have certainty that the human running the account is who they say they are (anyone can make a GitHub account and make it look like a real person). Not everyone who wants to use a container system understands the underlying code of that container system. If I’m a web developer using Docker Desktop or podman to build my PHP app, I’m not necessarily going to understand the code written in Go when my specialty is PHP.
  - puquesnrn 3y ago
    yes it does. There’s only one contributor for most of it and you can click to see his profile. With the source code available and the primary contributor clear, what more could anyone want? Certainly it’s a bit much for one to ask for a security audit they themselves won’t do
    - aflukasz 3y ago
      > With the source code available and the primary contributor clear, what more could anyone want? Reproducible builds. :)
    - dangus 3y ago
      How hard is it to make a GitHub profile? If I am a developer using podman/Docker to build my PHP images, am I expected to understand code written in Go? These are all acceptable risks until someone is asking me to disable SIP.
tmpX7dMeXU 3y ago
Which answer to this question would sufficiently comfort you?
puquesnrn 3y ago
> There's no indication who made it. It clearly links to the GitHub where you can click to see all contributors I suppose the answer to your question is “people who want macOS containers”, whoever they are. As far as malware, I’d employ whatever your standard practices are for installing GitHub projects

Squarex 3y ago

Looks like it's open source https://github.com/macOScontainers https://github.com/macOScontainers

ThePowerOfFuet 3y ago
Unfortunately, that doesn't answer their question.
- RockRobotRock 3y ago
  It answers both of their questions. Git lets you see the author and they can audit the code if they like.
  - dangus 3y ago
    IMO that’s not good enough, especially when disabling SIP is involved. We don’t even have certainty that the human running the account is who they say they are (anyone can make a GitHub account and make it look like a real person). Not everyone who wants to use a container system understands the underlying code of that container system. If I’m a web developer using Docker Desktop or podman to build my PHP app, I’m not necessarily going to understand the code written in Go when my specialty is PHP.
- puquesnrn 3y ago
  yes it does. There’s only one contributor for most of it and you can click to see his profile. With the source code available and the primary contributor clear, what more could anyone want? Certainly it’s a bit much for one to ask for a security audit they themselves won’t do
  - aflukasz 3y ago
    > With the source code available and the primary contributor clear, what more could anyone want? Reproducible builds. :)
  - dangus 3y ago
    How hard is it to make a GitHub profile? If I am a developer using podman/Docker to build my PHP images, am I expected to understand code written in Go? These are all acceptable risks until someone is asking me to disable SIP.

tmpX7dMeXU 3y ago

Which answer to this question would sufficiently comfort you?

puquesnrn 3y ago

> There's no indication who made it. It clearly links to the GitHub where you can click to see all contributors I suppose the answer to your question is “people who want macOS containers”, whoever they are. As far as malware, I’d employ whatever your standard practices are for installing GitHub projects