Dear yuletide author:

Oct. 25th, 2014 02:46 pm
raven: subway sign in black and white, text: "Times Square / 42 Street station" (stock - times square)
[personal profile] raven
A quiet moment for this, finally! Dear [community profile] yuletide author, thank you very much for writing for me. I'm delighted that you like one or more of these small fandoms as much as I do. My AO3 name is [archiveofourown.org profile] singlecrow, just for reference.

Generally, about me: I like found families, competence, people showing their love for each other in small and unconventional ways; I like angst and woe, but not hopelessness; I also like stories that are people in the worlds they inhabit, living their lives. I like gen and queer gen a lot, though honestly you should feel free to pair whoever with whoever, that's all fine with me.

I have no triggers or squicks in particular, though I don't tend to like PWPs very much.

Here are my requests:

Imperial Radch - Ann Leckie )

Frasier )

The Best of All Possible Worlds - Karen Lord )

Jonathan Strange and Mr Norrell )

In conclusion! Thank you again for writing for me, dear author; if you enjoy writing it, I will enjoy reading it, I guarantee you.

Raven

Ideas for comic!

Oct. 25th, 2014 10:47 pm
alias_sqbr: (genius!)
[personal profile] alias_sqbr
I have to draw a four+ page comic for a coursera course I'm doing and I am TOTALLY BLOCKED.

I'm thinking I'll just adapt part of an existing story, either one of mine or something in the public domain.

Current thoughts tend towards Northanger Abbey but I am open to suggestions! Are there any public domain works, or original/fanfic of public domain works by me that you'd like to see me draw a short story about? Any art of mine you'd be curious to see expanded into a longer story (and have plot ideas for)? AUs are totally welcome but not nonsense crossovers because then I get tangled up figuring out how it WORKS.

It has to be accessible to random strangers so no asking me to write an ending to A Circle of Stars :P Also there is no guarantee I'll actually draw any of it comics are haaaard. BUT I WILL TRY

Also: Penny, I have not forgotten your Asama & Korra prompt, I plan on drawing it the moment the show gets them to a point where I'm not all "Asama & Korra ;_;"

ALSO speaking of AO3 today was FEMSLASHEX REVEALS YAYYY. I drew some Velanna/Sigrun. And I got TWO gifts: Undercover by kiki_miserychic, which is some sexy Root/Shaw art, and Quantum Relations by Settiai which is a very cute EDI/Sam fic.

This course is good but hardddd. I had to write TWO ESSAYS. With an introduction and a thesis and a CONCLUSION. urrrrggghhhhhh essayssssss. Of course we got half marks for even trying because coursera. But the peer assessors said I LACKED A COHERENT THESIS. Luckily we get to do self evaluation too so there was a "you are amazing and all your ideas are gold" to balance things out.

Spirits on the move

Oct. 25th, 2014 01:13 pm
qian: Tiny pink head of a Katamari character (Default)
[personal profile] qian

A few Spirits Abroad-related updates ….

Fixi has sold (most of) the first print run, so the book has gone into a second printing! Really delighted about this. Thanks to everyone who bought a copy.

image

The book’s back in stock on Amazon, so you can order it here if you would like the paperback: Spirits Abroad at Amazon.

(If you want to order the book on Amazon, don’t worry if it looks as though it’s out of stock — the reason for this is that Amazon is conservative and only orders as many copies as it needs to fulfill customer orders, plus a few extra. But Amazon always orders enough to fulfill orders placed by customers, and Fixi has plenty of copies going spare, so if you place an order you’ll definitely get the book — it may just mean you’ll take a little while to receive it.)

And there’s always the ebook version, of course. Most of the Fixi Novo books are now available on Smashwords, if you’re interested in trying out Malaysian pulp: Fixi Novo at Smashwords.

image

Spirits Abroad is kind of the odd duck out, as I’ve now hiked up the price to a princely US$3.99, plus of course the lavish detail of Likhain‘s cover is very different from sleek Fixi Novo house style.

Speaking of which, Likhain’s posted about the process of creating the piece that became the cover: Call it abundance.

I want to say there are voices and stories that cradle our hearts when we’re at our most fragile and closest to breaking, and it’s these voices that we return to time and time again — we can trust them with our pain, our bodies, our selves.

image

She’s sending me the painting! So excited. We have just moved, and I dream of colours on our walls. (Er, leant against the walls rather than affixed to them in any way that would breach the terms of our lease, of course).

Likhain’s also a brilliant writer, and her poem has just appeared in Strange Horizons: Seeds by M Sereno.

Swallow a seed and it will sprout within you,
becoming your veins, invading your bones.
Those poets and conquerors knew this. Knew the mouth is an altar.

It’s about a lot of stuff. Do read it.

Mirrored from Zen Cho.

(no subject)

Oct. 25th, 2014 07:29 am
copperbadge: (Default)
[personal profile] copperbadge
YOU GUYS. I GET A COUCH TODAY. I'M VERY EXCITED.

The "I don't own a couch" issue became more of an issue and less of a running joke in the past few weeks, as we drew closer to my surgery date in November, since Mum will be here and while I have an air mattress for her to sleep on (seriously, it's the best air mattress ever), I don't have many places for either of us to sit during the day.

The Fauxfa, made of a futon nailed to a wall and a bedroll on top of it, wasn't going to cut it.

So mum went and tested out sofas at Ikea, and when it was a toss up between a cheap one I liked and an expensive one she liked, she said she'd make up the difference.

COUCH COMING TODAAAAAY.

In the meantime, have some threesome fic! No couches are involved, just a large bed.

Title: Devils and Heathens
Rating: R
Summary: Peggy Carter didn't go looking for trouble, or Bucky Barnes, or a threesome. Sometimes these things just find you.

Here on Dreamwidth | Here on AO3

fic snippet: undercover

Oct. 24th, 2014 11:12 pm
cofax7: Three women: Leia, Starbuck, Zoe (Three Women -- Body)
[personal profile] cofax7
What it is, is obvious. If you pay attention to various casting decisions...

They weren't going to find a body )

Yeah, so I don't read the comics, and I don't really know the character, but c'mon, you know I had to tell that story.

Dear Yuletide Writer

Oct. 24th, 2014 08:22 pm
skogkatt: Sabrina the Teenage Witch (Nerd Girl)
[personal profile] skogkatt
Dear My Person,

Thank you for offering to write in one of these obscure fandoms! I will certainly be thrilled with whatever you come up with, but in case you want extra brainstorming nudges, this letter is for you!

Sabrina the Teenage Witch (tv)

Here's what I said on the official thing:

I love this show, especially for the interactions between all the residents of the Spellman household. Anything in this world would be awesome, but if you need ideas, how about deleted scenes from season 1? Or some of the backstory about Salem's failed rise to power? Or a Halloween story? I mean everything goes haywire at Halloween over there! Or a Christmas story? Or perhaps something to explain how exactly Sabrina ended up having two junior years? Did it have something to do with the time ball or Hilda's magic clock?

Additional info:

I ask for this every year just in case someone out there really wants to write me a wonderful Sabrina story. I love this universe, and will honestly be thrilled with any story. I know I asked for four specific characters. I love them, and would love to see them having some snappy banter, but I'm also way open to other things.

Use your favorite characters, make up new characters, cross it over with other shows or books or movies, or give me explanations for some of the weird series plotholes (Whatever happened to Jenny?). I will love any of it. Season 1 is my favorite for the geekiness of the writing, but I'd be happy to read about characters from other seasons, too. If you want to include chromatic characters, you might consider writing about Albert (the Quizmaster) or Dashiell (what happens to him after he and Sabrina stop seeing each other?) or Aunt Vesta (we really only see her once!), or Dreama, but again, I'll be happy with whatever you choose.


Austenland

Here's what I wrote on my official request form:

This was just a lot of fun, wasn't it? I love Miss Charming, and I'd love to see more of these characters whether before, during, or after their stay at the manor. Do they perhaps become lifelong friends? Do they go back for another visit? Does Miss Charming ever find a willing British bloke?

Additional details:

Basically I think Jennifer Coolidge is hilarious, and I love that the two women are friendly and supportive of each other. I like kind people and witty banter and extreme silliness, so I would love to see good natured ridiculousness, or snappy romantic banter, or what have you. There are so many fun possibilities! Do Jane and Nobley perhaps discuss the Austen novels together? And if yes, does Miss Charming try to add her input? Because that sounds like a recipe for hilarity.

H2O: Just Add Water

Here's the official request:

Okay, I have to say Rikki is my hero. I love her. She's totally cool and she knows what she wants and goes after it, and she doesn't take any BS from anyone. I'd love to see more of her. That said, I also love Cleo and Emma, and I'd love to see more of them too. One of the strengths of this show is the friendship between the three main characters. Also, I love how Cleo is a big old nerd who knows all about fish and dresses up as a jellyfish for the beauty pageant. I would be happy to see anything in this world, but if you need ideas, how about something about what actually happened to Emma. She left pretty abruptly. Does she ever come back? Is she still a mermaid? What happens to all of them after the end of the show? Do Cleo and Lewis ever get together for real? What happens to Rikki (please let it be something awesome!)?

Additional details:

I will be happy with anything in this fandom, but I also want to throw this one wide open. There seems like SO MUCH crossover potential here. Mermaids + Sabrina? Harry Potter? Twilight? I just have no idea. I know that the Mermaid actors went on to do The Vampire Diaries, but I am unfamiliar with that universe, so if you decide to use it, you'll have to make sure everything from it is understandable to someone who's never seen it. That said, I basically imagine the crack potential here is SUPER high, and I welcome that! OMG, I just thought of something: Mermaids + Outlander! How would that even work? Is the mermaid pool also a time portal? Seriously anything goes. Just please make it fun and fluffy, because I am really hoping for a non-angsty Yuletide if at all possible.


General likes and dislikes


I love: Silly things, weirdness, geekiness, fluff, kind people, strong friendships, happy endings, witty banter, diversity, feminism

I dislike: Excessive violence and gore (some is okay if is serves the story, but I squick easily), excessive angst (again, if it serves the story, great, but I don't tend to seek out sad stuff for catharsis/comfort the way some people do), any kind of sex that isn't explicitly consensual (really really, please no), racist/sexist/homophobic stuff (again, really, just no).

(no subject)

Oct. 24th, 2014 08:15 pm
synecdochic: torso of a man wearing jeans, hands bound with belt (Default)
[personal profile] synecdochic
Sarah, sitting and putting labels on the 150-odd vials of BPAL I decanted today: "You know, I don't think it was an unreasonable request."

Me, opening 200-some vials that I bought secondhand to sniff them and determine if I like them or not: "What?"

Sarah: "'One of these days I should find a perfume I can wear to work', I said. And here we are, somehow that having turned into 'try everything BPAL has ever made'..."

Me: ...Hello, have you MET ME? YOU KNEW IT WAS ON FIRE WHEN YOU LAID DOWN ON IT.

(She is so very tolerant of the fact that "....that escalated quickly" is my life motto.)

Dear Festividder...

Oct. 24th, 2014 10:31 pm
rhivolution: David Tennant does the Thinker (Default)
[personal profile] rhivolution
This is a placeholder post of goodness.

Dravidian languages

Oct. 24th, 2014 09:01 pm
marnanel: (Default)
[personal profile] marnanel
Today I drew a tree of the relationships between the Dravidian languages (because someone asked about Tamil). Source.

Working

Oct. 24th, 2014 02:44 pm
synecdochic: torso of a man wearing jeans, hands bound with belt (Default)
[personal profile] synecdochic
Working working working. Decanting decanting decanting. The cooking tv shows I'm watching in the background are making me hungry.

Read more... )

Friday, October 24th

Oct. 24th, 2014 10:53 am
alexandraerin: (Default)
[personal profile] alexandraerin
The Daily Report

So, the poem I have been talking about? I don't want to jinx anything by being overly specific before it's actually on the publication docket, but for now, let it simply suffice to say that it has been accepted by a paying market.

That's really the only topic on my mind this morning, so I don't have much else to say in this report. I did succeed in keeping up my random productive writing streak yesterday. It's another piece of flash fiction and not something that's likely to sell, at least not by itself, but if nothing else, it's another Halloween monster tale I can slip into the newsletter next Friday.

The State of the Me

General soreness continues. I was also up late last night as the excitement over my poem, so we'll see what happens.

Plans For Today

Today's going to be entirely MU-focused. I've been bouncing ideas around for fulfilling the bonus story, since that mark was hit almost as soon as it went up. That's going to be my "random side writing" project for the day.
alexandraerin: (Default)
[personal profile] alexandraerin
...I don't think I mentioned that I have in fact joined the WisCon convention committee as a member of the media & communications team. In the long-term, I would like to take a more active hand in the public internet presence of the convention, but right now those things seem to still be in a bit of a transitional mode. I have been helping to craft and polish external communications a bit, where I can.

I volunteered my skills because communication is one of my strong points, but also because it's been one of the con's weak ones, in both directions: listening and speaking. The idea of a media & communications team is a fairly new one and its role is still being defined, but my personal take on it is that our role should include listening.

During the crises of trust that resulted over this summer from the handling of abuse claims, there was a persistent refrain from within the ConCom about the importance of maintaining a single channel of information in order to prevent confusion and rumormongering. As an outsider to the ConCom, I challenged this line of thinking several times by asking if anyone really thought that it was working. From my position on the ground, it seemed pretty clear that the attempts to maintain a wall of silence did nothing to alleviate confusion, and created the circumstances that led to the circulation of rumors.

In fact, I think we must give credit where credit is due. If not for the ConCom members who broke silence and "told tales outside of school", either publicly or in confidence, then a number of people who ultimately increased their involvement with the con might have otherwise left it for good.

I know that's true of myself.

This is why I can't turn around and co-sign a policy of squelching open discussion. The convention is run on a consensus model, though, so while I will be defending this idea vigorously, I cannot unilaterally implement it. Still, it is the viewpoint that I will represent.

This is a time of change for the con, and its leadership. A lot of things are still up in the air. A lot of things have yet to be determined. This much is true: the con belongs to its members, but the big decisions will be made by those who do the work to make them happen. We have an opportunity here, and a responsibility to use it wisely.

First days of school

Oct. 24th, 2014 09:14 am
puzzlement: (jelly)
[personal profile] puzzlement posting in [community profile] incrementum
Originally posted to incrementum.puzzling.org. Comment there unless you have a Dreamwidth login.

As foretold in the prophecies, V recently began his two day a week “Headstart” kindergarten transition program earlier this week.

Here he is in the playground waiting for it to begin:

First day of "school"

And here he is settling in with one of the classroom tasks (they had three tables set up, one with drawing, one with craft, and one with puzzles):

First piece of school work

He drew this, and explained that it is the sun and a path, indicating a winding path with gestures:

First school "work"

I asked if he wanted to add some more colours or make any changes and he firmly said no. I was both impressed that he drew something that is indeed clearly the sun and a winding path in under a minute, and a bit startled that he doesn’t have any idea that it can be worth putting more than a minute into artwork, or at least it can be fun. All with time, I guess.

The parents awkwardly stuck around for about half an hour, waiting, I think, for some kind of firm signal to be gone. When none came, we all slowly drifted out one by one. I don’t think any kids were especially distressed. V wanted a few cuddles while I was still there.

When I picked V up (at 2:30pm I pick him up, walk him to daycare, and leave again, it’s going to be a nightmare) he took me to the smart board, which was showing a class photo they’d taken the first morning and he pointed firmly at “my friend”. I asked what her name was, he said he didn’t know. As we walked to daycare, I asked him for more details of the day and he informed me that it was a SECRET and he COULDN’T tell me, which is a novel variation on the traditional answer to asking a kid about their school day: “um, I don’t know”.

The second day went fine. There was a very small parent morning tea after with a few parents and then we left. After school, he told me he played with “my boy friend” because “my girl friend” hadn’t been there. (This may be so, there are a surprising number of children only going to one of the two days each week.) And he recounted in some detail how the toilets are gender-segregated. (This has in the past interested him about ski school and the pool. It’s not true of his pre-school.)

Now it’s all about how to fit his schooling into our life. I’ve already set up an elaborate calendar for the days when Andrew will have to leave work for the 2:30pm transition because I’m working in the city or out of town. (Five times total, out of sixteen days.) This goes with the elaborate and constantly updated calendar of who drops the children at daycare and picks them up each day. This will all get a bit easier next year when he can access the after-school care, but even so.

Diwali 2014

Oct. 23rd, 2014 11:15 pm
raven: image of India on a globe (politics - india)
[personal profile] raven
Happy Diwali to you and yours, my friends. It's been an exceptionally long day, so I'm just going to give you the usual image, and three short stories.



[image description: a darkened room, with several candles and a candelabra in this window, and an orange lamp

That's from last year: but we're still here.

dancing in the dark
Brooklyn Nine-Nine, Rosa/Amy.

in the middle of all the yelling )

always one last bell to ring
Imperial Radch, Breq, Seivarden, Tisarwat & co. [NB re: spoilers for Ancillary Sword - they're minor, but to be honest this won't make sense without it!]

hanging the lights )

two drifters off to see the world
How I Met Your Mother, Tracy and Robin

moon river )

The Internet I Knew

Oct. 23rd, 2014 04:02 pm
flowerhack: (Default)
[personal profile] flowerhack
Today the upstart social networking site Ello reaffirmed their promise to never sell user data or ads. Which is good for them, I suppose, but the following line from their announcement made me frown:
With virtually everybody else relying on ads to make money, some members of the tech elite are finding it hard to imagine there is a better way.

But 2014 is not 2004, and the world has changed.
We... we had ad-free social networking in 2004. It was called "one of your friends got a Dreamhost and put some forum software on it and everyone hung out there." If the website got really big and popular, maybe the owner would ask for donations from the users, and usually folks would give enough to keep the place afloat, because everyone wanted to keep hanging out there.

It wasn't glamorous. It didn't give anyone rounds of VC funding or make anyone rich. Sometimes the site would crash from some "IPS driver error" and a grumpy teenager with the heart of a future sysadmin would crawl onto AIM at 2AM to tell everyone they were working on a fix.

But we existed. And for some reason I can't help but feel a little slighted. Ello didn't invent the concept of people hanging out online without ads. (Take, for instance, the very site you're on now, Dreamwidth: another great example of a community bootstrapping and sustaining itself.)

I had similar grumpy feelings when Pinterest was blowing up a few years back—not because of any ill will toward Pinterest, but because of the breathless, astonished tone reporters seemed to take when talking about Pinterest. In particular, they seemed staggered by the fact that the site's users were almost all women, bringing them together in a way never seen before, and how did Pinterest discover the secret of drawing women to the internet?!

And yet, the "social networks" I hung out on during my preteen and teenage years were composed almost entirely of young women. I'm not even sure why that was the case—we talked about gaming and tech a lot, which were supposedly "guy" interests when I was a kid—but it was a prevalent enough gender skew that, on the rare occasion when someone joined with an obviously male handle, we'd joke about how "but there are no boys on the internet!" We were there the whole time; we didn't just starting using the internet when Pinterest came out.

I suppose it's the difference between a Social Network TM in the Facebook and Google+ sense, versus the "social networks" I remember. Those "social networks" were small, and never made front-page news (or any news at all), and were more concerned with keeping to themselves than recruiting new members. They were "social networks" in the "people getting together and hanging out" sense. But Social Networks TM are big, and self-promote, and have money and influence, because there's a lot more people on the internet nowadays and more money to be made.

Which is fine. I just don't think it should be billed as this Totally New Thing. All sorts of folks have been on the internet for a long while now. Let's acknowledge that, at least a little.

Also of interest: Paul Ford's tilde.club and "how LGBTQ nerds helped create online life as we know it."
wiscon_posts: (Default)
[personal profile] wiscon_posts posting in [community profile] wiscon
From the SF3 board (WisCon's parent organization):
In response to member concerns, Piglet Evans has stated that she will not volunteer for Safety positions at WisCon in the future, and will recuse herself from handling reports of harassment or related matters in any other ConCom position. We further guarantee that she will be held to this. We thank Piglet for her cooperation, and for her years of service in many capacities.
Comments can be sent to SF3's Corresponding Secretary: sf3@wiscon.info

Dear Yuletide Writer 2014

Oct. 23rd, 2014 08:24 am
yasaman: text of yuletide magic with blue lit candle (yuletide)
[personal profile] yasaman
Most of this letter is c&p'd from years past, because I'm a predictable person I guess.

Another year, another Yuletide! Thank you for signing up to write in one of my fandoms! I can't wait to see whatever you come up with, and with these fandoms, chances are I'll love whatever it is you choose to write. If my requests/prompts/details don't catch your interest, just remember that Optional Details Are Optional, and that I will be thrilled to get fic in any of these fandoms at all.

As far as my basic preferences go: I am okay with gen, het, slash, and femslash. If I've indicated a pairing preference in my request, don't feel pressured to write it! I'm a big gen lover, and I'll specifically note if there's a pairing I don't want to see with the characters I've requested. Also, a confession: I usually skim through sex scenes. I know, I know, what am I doing in fandom if I skim past the porn. But I am almost always way more interested in character interaction than in sexy times. Feel free to include sex scenes! I'd just really prefer that porn not be the whole point of the fic. Things I love: banter, subtle but meaningful declarations of love and/or trust, characters finding home and family with each other, the smaller moments of domesticity or the calm before the storm, crossovers, epic and detailed worldbuilding, women being complex and awesome, hilarious shenanigans, and indulgent emotional hurt/comfort. For a giant list of my narrative kinks, see here. Things I don't love: dark fic, character bashing, character death, non-con, infidelity, incest, alpha/beta/omegaverse fic. Also, while I generally love AUs, I love these fandoms for their settings and the characters in those settings, so I'd prefer no AUs.

1. The Last Samurai - Helen Dewitt (Ludo and Sybilla)

Read more... )

2. Lumatere Chronicles - Melina Marchetta (Lirah, Gargarin, Arjuro, Froi)

Read more... )

3. A Bag of Hammers (2011) (Ben, Alan, Kelsey)

Read more... )

4. True Detective

Read more... )

5. Miss Fisher's Murder Mysteries

Read more... )

Thursday, October 23rd

Oct. 23rd, 2014 10:12 am
alexandraerin: (Default)
[personal profile] alexandraerin
The Daily Report

Well, I woke up this morning to a very encouraging response to the poem I mentioned the other day. We'll see how things go there. I don't want to say too much and jinx things.

On the subject of encouraging things: as I mentioned in a post yesterday afternoon, I've written a 10,000 word story I'm going to be submitting to an anthology in a week or so (as that's the deadline). That might not seem like a lot of time to polish such a long piece written in five hours, but while it could use some tightening and strengthening, I've honestly had pieces in rougher condition be accepted for publication before. I think at this point, great first drafts are officially one of my superpowers.

I tell you, I talk a lot about how writing (and creative work in general) depends on confidence a lot, and I think of doing random bits of side writing as getting up my confidence by Doing The Thing repeatedly, but this week has been great for my confidence all around.

The State of the Me

My body is all over the place this week: up, down, turn around, please don't let me hit the ground. I'm at the point where hurting a little bit all over is pretty much registering as okay. I think it's got a lot to do with the weather, which is similarly variable.

Plans For Today

I think today's likely to be the day that breaks my "reasonably finished, self-contained work" streak. After this is posted, I do plan to find something to noodle around with but I don't have any real solid ideas. Eh. The point of random writing isn't just the gems.

Linux Container Security

Oct. 23rd, 2014 08:44 am
[personal profile] mjg59
First, read these slides. Done? Good.

Hypervisors present a smaller attack surface than containers. This is somewhat mitigated in containers by using seccomp, selinux and restricting capabilities in order to reduce the number of kernel entry points that untrusted code can touch, but even so there is simply a greater quantity of privileged code available to untrusted apps in a container environment when compared to a hypervisor environment[1].

Does this mean containers provide reduced security? That's an arguable point. In the event of a new kernel vulnerability, container-based deployments merely need to upgrade the kernel on the host and restart all the containers. Full VMs need to upgrade the kernel in each individual image, which takes longer and may be delayed due to the additional disruption. In the event of a flaw in some remotely accessible code running in your image, an attacker's ability to cause further damage may be restricted by the existing seccomp and capabilities configuration in a container. They may be able to escalate to a more privileged user in a full VM.

I'm not really compelled by either of these arguments. Both argue that the security of your container is improved, but in almost all cases exploiting these vulnerabilities would require that an attacker already be able to run arbitrary code in your container. Many container deployments are task-specific rather than running a full system, and in that case your attacker is already able to compromise pretty much everything within the container. The argument's stronger in the Virtual Private Server case, but there you're trading that off against losing some other security features - sure, you're deploying seccomp, but you can't use selinux inside your container, because the policy isn't per-namespace[2].

So that seems like kind of a wash - there's maybe marginal increases in practical security for certain kinds of deployment, and perhaps marginal decreases for others. We end up coming back to the attack surface, and it seems inevitable that that's always going to be larger in container environments. The question is, does it matter? If the larger attack surface still only results in one more vulnerability per thousand years, you probably don't care. The aim isn't to get containers to the same level of security as hypervisors, it's to get them close enough that the difference doesn't matter.

I don't think we're there yet. Searching the kernel for bugs triggered by Trinity shows plenty of cases where the kernel screws up from unprivileged input[3]. A sufficiently strong seccomp policy plus tight restrictions on the ability of a container to touch /proc, /sys and /dev helps a lot here, but it's not full coverage. The presentation I linked to at the top of this post suggests using the grsec patches - these will tend to mitigate several (but not all) kernel vulnerabilities, but there's tradeoffs in (a) ease of management (having to build your own kernels) and (b) performance (several of the grsec options reduce performance).

But this isn't intended as a complaint. Or, rather, it is, just not about security. I suspect containers can be made sufficiently secure that the attack surface size doesn't matter. But who's going to do that work? As mentioned, modern container deployment tools make use of a number of kernel security features. But there's been something of a dearth of contributions from the companies who sell container-based services. Meaningful work here would include things like:

  • Strong auditing and aggressive fuzzing of containers under realistic configurations
  • Support for meaningful nesting of Linux Security Modules in namespaces
  • Introspection of container state and (more difficult) the host OS itself in order to identify compromises

These aren't easy jobs, but they're important, and I'm hoping that the lack of obvious development in areas like this is merely a symptom of the youth of the technology rather than a lack of meaningful desire to make things better. But until things improve, it's going to be far too easy to write containers off as a "convenient, cheap, secure: choose two" tradeoff. That's not a winning strategy.

[1] Companies using hypervisors! Audit your qemu setup to ensure that you're not providing more emulated hardware than necessary to your guests. If you're using KVM, ensure that you're using sVirt (either selinux or apparmor backed) in order to restrict qemu's privileges.
[2] There's apparently some support for loading per-namespace Apparmor policies, but that means that the process is no longer confined by the sVirt policy
[3] To be fair, last time I ran Trinity under Docker under a VM, it ended up killing my host. Glass houses, etc.
ktempest: just a picture of me with my awesome fan (Default)
[personal profile] ktempest posting in [community profile] wiscon
We are many, many months out from WisCon and from when we start the active push for panel suggestions. So it seemed like a good time for the first of what will be monthly panel brainstorming posts.

This is a space where anyone can ask for help in crafting the title, description, and other details of a panel they want to submit. Let us know what you need, such as: making a kernel of an idea into a full-fleshed panel, help crafting an effective description, coming up with a punchy title, or finding fellow panelists so you can submit a pre-populated idea.

Anyone may take part. If you're good at descriptions, join in! If you're good with conceptualizing, join in!

It will make discussions easier if you put one panel idea per comment (make as many as you want) and then folks can reply below each in the thread.

There will be a new brainstorming panel each month until panel submissions close. Spread the word :)
Page generated Oct. 25th, 2014 08:36 pm
Powered by Dreamwidth Studios