Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft repo installed on all Raspberry Pi’s

reddit.com

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Microsoft repo installed on all Raspberry Pi’s

#11

Post by someperson »

ClumsyPilot wrote: post #8

To put this into perspective, I'd like to kbow how many repos and gpg keys are there already. If microsoft was added to dozens others, then this is a storm in a teacup. If it when from 2 to 3, then the change is more significant. Lets keep in mind that the central goal of PI OS is education, not security, privacy, sticking it to corporates, IoT, etc.

Raspberry Pi has many product lines for industrial and IOT usage, including the Compute Module where security and privacy are expected. The standard operating system for such systems tends to be Raspbian Lite now called (Raspberry Pi OS Lite), which is affected by this issue.

Re: Microsoft repo installed on all Raspberry Pi’s

#12

Post by FreezingKeeper »

I'm not surprised by this:

- The RPi Foundation exists to educate children. There is no mention of "open" on their About page and there are the long running discussions about how open their hardware is and the reliance on proprietary blobs for the GPU [0]

- The 'maker' community interest was originally a surprise to them [1] which still staggers me given that Arduino had long been a thing

- MS has a history of capturing the budgets of educators and attention of young minds. The education computer market in the UK used to be dominated by Acorn and Apple until MS decided they wanted a piece of the pie and decided that computer education in schools should be about learning to use Office [2]

[0] https://www.raspberrypi.org/about/

[1] https://www.jbs.cam.ac.uk/insight/2012/raspberry-pi-2/

[2] https://www.cbronline.com/news/acorn_backs_away_from_uk_educ...

Re: Microsoft repo installed on all Raspberry Pi’s

#13

Post by BurpyDave »

lkramer wrote: post #7
BurpyDave wrote: post #4

At the risk of getting bashed, isn't 'pinging a Microsoft server' what happens every time I clone, push, or pull from GitHub? There might be be bigger issues to deal with than apt repositories if you don't want to ping a Microsoft server.

If you pull from a github server, you do so by choice. If you add Microsoft's repo to your apt sources, you do so by the choice. The problem is that the repo was added silently and without giving you a choice.

I suppose I get that, but surely that is happening all over the web all the time? I don't really have a choice about what is being pinged just by going to the Reddit site that mentions the issue (unless I use pi-hole, er...).

Re: Microsoft repo installed on all Raspberry Pi’s

#14

Post by someperson »

pedroaraujo wrote: post #6

This feels like a huge overreaction. "(...) every time an install of Raspberry Pi OS is updated it will ping a Microsoft server. Microsoft will know you're using Raspberry Pi OS/likely Raspberry Pi owner and your IP address." How is this is an issue? It doesn't require any login and this is exactly what happens with every APT mirror. I imagine that Raspberry Pi OS is an distro meant for people who simply want things…

It's not just educational desktop environments: this issue affects Raspberry Pi OS Lite which is the primary operating system for Raspberry Pi's used in embedded and IoT applications. Some of which have automatic updates (called "unattended upgrades" in Debian parlance).

Re: Microsoft repo installed on all Raspberry Pi’s

#15

Post by pedroaraujo »

someperson wrote: post #14
pedroaraujo wrote: post #6

This feels like a huge overreaction. "(...) every time an install of Raspberry Pi OS is updated it will ping a Microsoft server. Microsoft will know you're using Raspberry Pi OS/likely Raspberry Pi owner and your IP address." How is this is an issue? It doesn't require any login and this is exactly what happens with every APT mirror. I imagine that Raspberry Pi OS is an distro meant for people who simply want things…

It's not just educational desktop environments: this issue affects Raspberry Pi OS Lite which is the primary operating system for Raspberry Pi's used in embedded and IoT applications. Some of which have automatic updates (called "unattended upgrades" in Debian parlance).

But this doesn't grant remote access to your system, and it's not like Microsoft will start shipping replacements of core packages over this repo.

Re: Microsoft repo installed on all Raspberry Pi’s

#16

Post by severino »

pedroaraujo wrote: post #6

This feels like a huge overreaction. "(...) every time an install of Raspberry Pi OS is updated it will ping a Microsoft server. Microsoft will know you're using Raspberry Pi OS/likely Raspberry Pi owner and your IP address." How is this is an issue? It doesn't require any login and this is exactly what happens with every APT mirror. I imagine that Raspberry Pi OS is an distro meant for people who simply want things…

> How is this is an issue? It doesn't require any login and this is exactly what happens with every APT mirror.

Yes, but it's you who usually manage those mirrors, not some guy deciding which mirrors your apt must query now and pushing it in a regular update without notice.

I don't care if it's Microsoft or some obscure Chinese repo, but I think nobody should mess with your mirrors list or trust their keys in this way.

Re: Microsoft repo installed on all Raspberry Pi’s

#18

Post by SecurityLagoon »

pedroaraujo wrote: post #15
someperson wrote: post #14

Earlier quoted context omitted.

It's not just educational desktop environments: this issue affects Raspberry Pi OS Lite which is the primary operating system for Raspberry Pi's used in embedded and IoT applications. Some of which have automatic updates (called "unattended upgrades" in Debian parlance).

But this doesn't grant remote access to your system, and it's not like Microsoft will start shipping replacements of core packages over this repo.

Technically it does grant another avenue of supply chain attack... but if Microsoft run mirrors are being compromised then we probably have much bigger issues than some raspberry pis.

Re: Microsoft repo installed on all Raspberry Pi’s

#19

Post by pwinwood »

If I was going to use a Raspberry Pi for commercial use I would want full control over the OS and use Open Embedded etc, just like I have done for NXP etc. That way I have full control over my system. I think the alternative of using Raspberry PI OS and the dependency on updates on Raspberry Pi and their suppliers is too risky. So this is a non-issue for me.

Re: Microsoft repo installed on all Raspberry Pi’s

#20

Post by SecurityLagoon »

dvfjsdhgfv wrote: post #17
zoobab wrote: post #2

Redmond got finally a root shell on your Pi :-)

This is not even remotely true. All they have is the information that somene at $IP is using Rpi. Granted, I'd prefer not to give them this info, but let's stick to the facts.

This technically does give them the ability to backdoor your system if they supply an "update" for something you have installed via another repo... but that is very far fetched, obvious to anyone paying attention, and would be hell for their PR for minimal gain.
Post reply on HN