61–70 of 143 posts
Earlier quoted context omitted.
Look, if the malware spreads by users manually installing it , 1. it's not really an OS problem, 2. an AV wasn't going to save them.
That's how almost all malware was installed though. Linux really isn't any more resistant to malware than anything else.
Earlier quoted context omitted.
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
Who is running random curl scripts without checking the code first? Is this common now?
``` curl -sfL https://get.k3s.io | sh - ```
Why would you use a "Free Download Manager" when wget is right there? Or a web browser, such as Firefox? Or torrent clients to deal with large Linux ISO downloads? Or the various storefronts, like Steam? Or your own distro's package manager? This wasn't packaged on any distro, so this isn't even a meaningful attack: Users had to go out of their way to install it from a foreign source. This is no different than if you…
From their website[1]: > FDM can boost all your downloads up to 10 times, process media files of various popular formats, drag&drop URLs right from a web browser as well as simultaneously download multiple files! No, I still don't a clue what it actually does that the OS and existing tools can't. It sounds like those scam "RAM doubler" programs from the 90s. Run this executable to boost your system's chakras . 1: htt…
Earlier quoted context omitted.
> This is installed by adding a shady repository to your apt sources.list... How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?
Yes, they are signed, but not with the official key. If you add it through the UI, it will auto-accept the key from the repository. (I'm not sure how it exactly works, it might ask the user for the confirmation) If you do it from the command line, by editing files, you will have to add the key manually. But most inexperienced users will just copy/paste and run the "curl | sudo apt-key add" command from the shady repo…
More here: https://medium.com/@glegoux/ubuntu-22-04-jammy-jellyfish-apt...
Earlier quoted context omitted.
I disagree. This is more another reason to not run programs which are not from the official repository.
Even packages from the official repos can not be safe. https://www.debian.org/security/2008/dsa-1571 I would just like to remind everyone to be cautious, in general. This bug was in the openssl package, and as a consequence was creating incredibly weak keys, for around 2 years before being discovered in what is arguably one of the most critical pieces of software for the OS.
Earlier quoted context omitted.
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
I never understand why people get more upset about the bash script running arbitrary code than the program it's actually installing.
IME most of the randomly-downloaded software I've used does what it says on the tin. But there is a whole screening process: where did it come from? Does the originating site look legit? What are the possible motivations for the creator?
Besides there is no signing mechanism for your random install.sh. Maybe you check the SHA256 but if an attacker alters the script why not alter the website with the hashes too?
Earlier quoted context omitted.
Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…
It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2] [1] https://en.wikipedia.org/wiki/FedRAMP [2] https://slsa.dev/
Earlier quoted context omitted.
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
Who is running random curl scripts without checking the code first? Is this common now?