Hacker News Reader

notjackon How MacArthur Geniuses Handle Their Windfalls

Additionally the MacArthur grants are divided into quarterly payments over five years, so you're not getting 625k all at once, you're getting 20 payments of $31,250, one every three months. That makes it pretty much impossible to blow all of it within half a year.

notjackon How MacArthur Geniuses Handle Their Windfalls

Note that because of the way tax brackets work, it is not possible for a small increase in income to increase your taxes to the point that it's a net decrease (due to tax brackets anyway). If you're just below the next tax bracket, and you get a ten dollar raise, only those ten dollars are taxed at the higher rate. All of your previous income remains taxed the same as it was before.

notjackon Don't expose the docker socket, even to a container

First let me state that this article is interesting and well written and taught me something new, thank you for that.

However my main frustration is I'm not really sure what the article is advocating for here. Instead of not giving access to the docker daemon to containers (which is legitimately needed for complex deployments where one container needs to dynamically start up "sibling" containers, e.g. a CI service), wouldn't it make more sense to talk about not viewing Docker container security the same as VM security in the first place?

Sure if you're going to do that anyway it makes sense to disable access to the socket, but then there's a million other things you'll have to do because docker containers are currently not primarily intended as a replacement for the isolation security of VMs. Their security is more like a useful extra layer, rather than a full blown replacement.

notjackon Don't expose the docker socket, even to a container

I should clarify I mean Docker containers specifically, good point.

notjackon Don't expose the docker socket, even to a container

This assumes that Docker containers are being used like VMs. They're not designed to allow running isolated arbitrary code in some sort of multi-tenancy setup, they're designed to isolate dependencies and configuration between your own deployed services. This is a "security vulnerability" in the same way that putting up a white picket fence around a jail is - a gross mis-application of a tool built for a completely different purpose.