Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why GNU/Linux Viruses Are Fairly Uncommon

gnu.org

Post reply on HN
Print view View original

81–90 of 117 posts

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#81

Post by necovek »

Godel_unicode wrote: post #58
commandlinefan wrote: post #55

Except that now everybody insists that you should be using package managers like apt and yum instead.

Who are these people? In the Python community, no project ever used yum/apt. Their versions of basically every package (where they even have it) are hilariously out of date with what you should use. They are frequently missing major security fixes, in addition to the usual functionality ones. My understanding is that this applies to most other languages as well. To say nothing of docker base images and popular docker…

I am the one saying that: for any Python packages in Ubuntu main, use them.

Why worry about tracking security issues of all your dependencies, when you can have that done by distribution's security team (Ubuntu pledges to patch all security bugs).

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#82

Post by delroth »

svd4anything wrote: post #74
wwright wrote: post #46

Earlier quoted context omitted.

I believe they aren’t just progressing towards reproducible builds, but that the whole system is already predicated on them. In Nix, you have to make special exceptions for packages that aren’t rebuildable from source.

Rebuildable is different than reproducible. The Nix system is predicated on rebuilding. Ideally the binaries would be all also reproducible however it turns out making compilation completely deterministic is actually pretty hard. When we reach that point and me and you can both independently produce identical binaries and hash them from exactly the same source code that is beyond fantastic for security and auditing.

r13y.com tracks the progress for NixOS reproducibility (well, for the tiny subset of nixpkgs that forms the minimal ISO image at least).

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#83

Post by IcePic »

acdha wrote: post #50
zanny wrote: post #24

Its a pet peeve of mine that the GNU/Linux world is 99% of the way to an incredible degree of security but distros are totally disinterested in going the last mile, often because its a lot of boring work. Mandatory Access Control should have been game changing in the security sphere, especially in the era of cgroups. Fine grained permissions controls in the kernel and filesystem would stomp out almost all potential m…

The distributions don’t have unlimited resources and the community can be a real deterrent: look at how much crap the systemd developers get every time they fixed a decades-old problem and then the angry mob shows up to complain about having to learn something new. I’ve been hoping that we’ll get there for a couple decades but SELinux was quite the reminder that when faced with work a lot of people will just turn off…

Oh, try calling in for support on that $1+M CommercialDatabase(tm) installation and tell them SELinux is turned on, or any other similar super expensive software. The 1st line will happily tell you that the most prized data you were willing to pay huge amounts for can't be protected by something so .. easy as SELinux.

They will not take your ticket until you turn it off and try again, and to your great surprise they will not be sharing their favourite selinux tagging configs with you.

So in the end, what can be protected with a decent SElinux config will be that statically generated catblogs-r-us.io site you run, but not the company financial database. "Priority inversion", or something to that effect.

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#84

Post by necovek »

chc-sc wrote: post #4
edoceo wrote: post #2

It's a joke, not analysis. Was hoping for the latter.

I think the real answer is that relatively few people use GNU/Linux

It's part that, but it's amplified by the fact that even in the tiny desktop GNU/Linux usage, there is no one GNU/Linux: a virus targetting a KDE, or GNOME, or XFCE, or—you get the point—something else, is targetting an even smaller part of that already small number of users.

Basically, the level of diversity in the ecosystem, while part of a reason for less widespread acceptance, also discourages any mainstream attacks.

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#85

Post by phaer »

waste_monk wrote: post #43
robrtsql wrote: post #25

Earlier quoted context omitted.

At the risk of appearing ignorant.. what exactly is the problem here? Do we trust the nodesource deb repo but we do not trust the bash script which is coming from the nodesource domain?

Deb packages have cryptographic signatures that can be verified to confirm it actually came from nodesource (or whoever) If you get MITM'd (admittedly difficult with TLS) or the site got compromised (but not the build IX / developer's keyring) it would be possible to replace the script with a malicious one. Also, you can detect the curl|bash installation method server-side and serve different content [1] on that basi…

> Deb packages have cryptographic signatures that can be verified to confirm it actually came from nodesource (or whoever)

And how do you get the GPG key to verify such signatures from third-parties? Usually via https from their website, no?

> Also, you can detect the curl|bash installation method server-side and serve different content

Yes, but you are supposed to trust people you get you packages from not to do it. And so and it should only make a difference if their servers are compromised and they sign packages with a key stored offline.

I think the latter is much less common then one would hope, with release processes in CI and such.

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#86

Post by goatinaboat »

fao_ wrote: post #26
chc-sc wrote: post #4

Earlier quoted context omitted.

I think the real answer is that relatively few people use GNU/Linux

> I think the real answer is that relatively few people use GNU/Linux 95% of the server market, though. Which is a huge proportion of attack space. Why steal one sod's credit card numbers when you can steal 100s of them at the same time.

Right. Every time you read about a million credit cards being stolen it’s almost certainly from a Linux server, meanwhile the community is patting itself on the back because no viruses are targeting the tiny number of Linux desktop users...

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#88

Post by pfundstein »

dead_mall wrote: post #80
pfundstein wrote: post #15

Earlier quoted context omitted.

Most malware code I've seen is terribly written and barely works. Hobbyist malware programmers use Windows and write for Windows for the simple reason that it's all they know. Some skiddies use Kali Linux but only because they managed to follow step-by-step instructions on YouTube without which they're lost.

> Most malware code I've seen is terribly written and barely works. Yeaah cause someone is just going to be so kind enough to share their perfect example of what malware code should look like to the rest of the world.. (actually there's an F ton available on Github, quasar, pupyrat, etc) Don't be so naive man. As a hobbyist malware programmer myself, I know that you don't know what you're really talking about other t…

> As a hobbyist malware programmer myself, I know that you don't know what you're really talking about

Let's see some of your code.

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#89

Post by jancsika »

wahern wrote: post #45
zanny wrote: post #24

Its a pet peeve of mine that the GNU/Linux world is 99% of the way to an incredible degree of security but distros are totally disinterested in going the last mile, often because its a lot of boring work. Mandatory Access Control should have been game changing in the security sphere, especially in the era of cgroups. Fine grained permissions controls in the kernel and filesystem would stomp out almost all potential m…

The person best positioned to lock down a program is the developer. Only they know when and how certain resources need to be accessed, and only they are positioned to refactor the source code to maximize the cost+benefit of stricter security policies. But solutions like selinux, apparmor, and tomoyo are built on the premise that it's the user, administrator, or packager best positioned. But this is a false premise. T…

> The person best positioned to lock down a program is the developer.

The person best positioned to lock down a program is the maintainer of the platform on which all the other programs run.

In fact the individual program developers should strive not only to ignore security altogether, but to develop a common set of tools that delivers arbitrary third-party code to the user's machine. This makes security theater unlikely as any given developer will only have expertise in their program proper and not in the security of their program plus the arbitrary third-party code. This also ensures maximum velocity of domain-appropriate development and focuses on ease of program installation-- the exact opposite of the problem being parodied in the article.

That velocity will rapidly grow the platform. This neutralizes any efforts to thwart progress through ad hoc program lockdown as futile. At the same time it puts massive pressure on the platform itself to gracefully handle misbehaving programs lest systemic insecurity decrease installation velocity.

Thus you get a system where arbitrary programs may be installed as quickly as possible with a security model that works even if 100% of the programs installed are malicious.

The cost is that arbitrary user data is exfiltrated during most program installations and runtimes (but that is a minor implementation detail).

Re: Why GNU/Linux Viruses Are Fairly Uncommon

#90

Post by [deleted] »

pfundstein wrote: post #76
yesenadam wrote: post #52

Earlier quoted context omitted.

Maybe if it's 'good' you don't see it? Like we only hear about the criminals that get caught...

The funny thing is the most advanced malware out there today (that we know of) was created by the US and Israeli governments. [1] https://www.symantec.com/security-center/writeup/2010-071400... [2] https://www.computerworld.com/article/2934593/duqu-2-0-kaspe...

[deleted]
Post reply on HN