In their testing, they determined that every password that used Bouncy Castle’s broken bcrypt implementation ... Friends don’t let friends run untrusted Docker images, at least according ...