> Hello scdf! > That was a bad idea. Don't copy code from websites you don't trust! Or indeed, download software from websites you don't trust. I guess the worry would be that hackers would, as an example, take over brew.sh and do bad stuff with installation url. As opposed to taking over brew.sh (in an alternate world where brew.sh hosts a dmg file or something) and hosting an entirely different file. Bar the relati…
Most terminal users these days are intelligent enough not to download a random executable from a google result and run it locally under root (without researching it). We've been well inundated not to ever run sketchy programs that you've never heard of. However, a huge portion of people (who this article is targeting), will freely copy and paste a terminal command from a random google result. That makes it a great at…
What about stack overflow? Surely they are trustworthy. But if someone hacks them, and inserts an attack like the OP's, then you are in trouble.
There are two problems. First, the hardware we own is almost comically powerful, both in compute and network bandwidth. Second, that same hardware mediates between us and everything that is important to us: our lovers, friends, business partners, banks, and so forth. A subtle enough hacker might get into our system and we might not know it, ever. (Indeed, if the hardware manufacturer put some secret code into their stuff then such a hack might be very subtle and very universal indeed.)
I'm not throwing my hands up and saying it's all pointless. But consider that your typical gigabyte program has a tremendous amount of surface area to check. And no, you can't discount "dumb" resources like images and videos because they aren't executable. A smart attacker will encode instructions in, say, a viral YouTube video that will trigger those hidden CPU instructions that will load a steganographically encoded program. For now we have to be practical, and not freak out. For the future, we have to move toward smaller, more efficient software that makes unexpected computation and resource usage obvious from an outside observer. This means small code, short call-chains, and minimal screen, network or disk interaction.
(I'm particularly worried by the trend for basically all software to be constantly connected to multiple unknown external hosts, any of which could be controlling code on my machine at the same level as the program I installed!)