111–120 of 143 posts
Earlier quoted context omitted.
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
Who is running random curl scripts without checking the code first? Is this common now?
Earlier quoted context omitted.
A few years ago I asked a new hire to ssh to a certain machine from their new dev Linux laptop, and they said OK and began searching the web for PuTTY for Linux. Didn't work out with them.
Years ago, I asked data scientist (with a PhD) whether his jupyter notebooks were only on his laptop or whether they were backed up on a server. He said they were on a server. I wanted to make sure whatever server that was had regular backups, so I asked for the server name. He looked at the URL bar and gave me the server's IP address: 127.0.0.1
This is one more reason to run every program in a sandbox rather than with full privileges.
A sandbox wouldn't keep you safe if you have to keep those vectors open.
Earlier quoted context omitted.
I never understand why people get more upset about the bash script running arbitrary code than the program it's actually installing.
Oftentimes the installer needs greater system access than the code you're running, particularly on Windows IME most of the randomly-downloaded software I've used does what it says on the tin. But there is a whole screening process: where did it come from? Does the originating site look legit? What are the possible motivations for the creator? Besides there is no signing mechanism for your random install.sh. Maybe you…
Earlier quoted context omitted.
Oftentimes the installer needs greater system access than the code you're running, particularly on Windows IME most of the randomly-downloaded software I've used does what it says on the tin. But there is a whole screening process: where did it come from? Does the originating site look legit? What are the possible motivations for the creator? Besides there is no signing mechanism for your random install.sh. Maybe you…
Aren't the most interesting things to steal already in the user's home folder, so having admin rights won't really give you that much more.
If you intentionally install something called Free Download Manager, you should not be surprised when it turns out to be malware.
Are you saying that maybe it should have been named Linux Download Manager to fool more people, or Debian Download Manager? Proving trust is hard.
Earlier quoted context omitted.
I disagree. This is more another reason to not run programs which are not from the official repository.
why do you think this can not happen in the official repository?
No one does think it can not happen, because that is a silly thing to even say. "can not happen" does not exist anywhere, there is only likelihood of happening, based on both history and motivation.
How often HAS it happened in any reputable distros official repos? They have all got decades of history by now so a good sea of data to generate solid statistics on frequency and distribution.
A Linux user that would install a Free Download Manager? We need to bring back complicated Linux installation processes. Vendors have dumb down the process to the point that idiots are getting cooties from downloading bullish!t.
A few years ago I asked a new hire to ssh to a certain machine from their new dev Linux laptop, and they said OK and began searching the web for PuTTY for Linux. Didn't work out with them.
Earlier quoted context omitted.
why do you think this can not happen in the official repository?
Why do you think "can not happen" even matters? No one does think it can not happen, because that is a silly thing to even say. "can not happen" does not exist anywhere, there is only likelihood of happening, based on both history and motivation. How often HAS it happened in any reputable distros official repos? They have all got decades of history by now so a good sea of data to generate solid statistics on frequenc…
https://security.stackexchange.com/questions/243455/was-ther...
however, cpan, npm, ports, homebrew, gems etc there are examples: https://docs.brew.sh/Acceptable-Casks#apps-that-bundle-malwa...
but i was hinting more at the: there are so many packages, and so many that are used rarely, that there is no way we know.
i think just running weekly modified files report and running things in sandboxes also dont give internet to all apps is good enough for me, and of course be critical of the sources you install from, reputable repos are better than non reputable ones, but are not immune.