Hacker News Reader

Maybe it's their business model? Sell to bunch of people and hook them in, then "get hacked", whoops sorry.

Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.

Not sure what you mean here. We have many enterprise customers, in industries including government, health care, financial services around the world. The whole value of the product is helping them avoid all the risk and work associated with poorly maintained container images. We publish a full SBOM for every image so you can see exactly what's inside of it. We've worked across the industry and OSS communities to enable scanning support as well, so you can easily use whatever scanning tools you currently use (e.g. Wiz, AWS Inspector, Grype, etc) to check our images.

How can we trust the image if we don't know what is inside? An sbom says what packages are installed but what is in the packages?

Alpine/debian packages show you the code that compiles the package from source, do you have that as well?

What are you even talking about?

Reply on news.ycombinator.com