Maybe you shouldn't install new software for a bit • Hacker News Board

Re: Maybe you shouldn't install new software for a bit

#61

Post by q3k » Fri, May 08, 2026, 1:49 AM UTC

TacticalCoder wrote: post #55

himata4113 wrote: post #44

Earlier quoted context omitted.

this, this is something I don't understand there are a billion ways to gain root once you control the user that regulary uses sudo. this is only scary for rootless containers as it skips an isolation layer, but we've started shipping distroless containers which are not vulnerable to this due to the fact that they lack priviledge escalation commands such as su or sudo. never trust software to begin with, sandbox every…

> this, this is something I don't understand there are a billion ways to gain root once you control the user that regulary uses sudo. I won't enter into all the details but... It's totally possible to not have the sudo command (or similar) on a system at all and to have su with the setuid bit off. On my main desktop there's no sudo command there are zero binaries with the setuid bit set. The only way to get root invo…

Yes, you are very special and smart. Good for you!

Most people however aren't and will happily run sudo after an npm postinstall script tells them to apt-install turboencabulator for their new frontend framework to function.

Re: Maybe you shouldn't install new software for a bit

#62

Post by xena » Fri, May 08, 2026, 1:49 AM UTC

andai wrote: post #60

Can someone help me understand the copyfail thing and how it relates to NPM packages? Edit: I think I understand. copyfail is a kernel bug that lets a malicious npm package get root access on your Linux server, right? So now, while there are unpatched servers, is when it would be the perfect time for attackers to target NPM packages. And the advice isn't just "update your kernel" because we are still finding new rela…

npm can run on linux.

Re: Maybe you shouldn't install new software for a bit

#63

Post by hluska » Fri, May 08, 2026, 1:54 AM UTC

bellowsgulch wrote: post #10

cbarnes99 wrote: post #7

It really pisses me off that responsible disclosure timelines are being ignored.

if you don't already consider responsible disclosure a quaint idea, you may want to grow warm on it the idea that it exists at all is more or less a gentleman's agreement in the engineering world anyway

[flagged]

Re: Maybe you shouldn't install new software for a bit

#64

Post by creatonez » Fri, May 08, 2026, 1:55 AM UTC

cbarnes99 wrote: post #7

It really pisses me off that responsible disclosure timelines are being ignored.

In this case, no insiders broke the embargo. It was reverse engineered from the patch by an unrelated third party and a proof of concept immediately came out of it. At that point, it's kinda fair game.

Re: Maybe you shouldn't install new software for a bit

#65

Post by tclancy » Fri, May 08, 2026, 1:56 AM UTC

marcus_holmes wrote: post #57

This was always a nightmare waiting to happen. The sheer mass of packages and the consequent vast attack surface for supply chain attacks was always a problem that was eventually going to blow up in everyone's face. But it was too convenient. Anyone warning about it or trying to limit the damage was shouted down by people who had no experience of any other way of doing things. "import antigravity" is just too easy to…

So, to play Pandora, what if the net effect of uncovering all these unknown attack vectors is it actually empties the holsters of every national intelligence service around the world? Just an idea I have been playing with. Say it basically cleans up everything and everyone looking for exploits has to start from scratch except “scratch” is now a place where any useful piece of software has been fuzz tested, property tested and formally verified.

Assuming we survive the gap period where every country chucks what they still have at their worst enemies, I mean. I suppose we can always hit each other with animal bones.

Re: Maybe you shouldn't install new software for a bit

#66

Post by ahpeeyem » Fri, May 08, 2026, 1:58 AM UTC

andai wrote: post #60

Can someone help me understand the copyfail thing and how it relates to NPM packages? Edit: I think I understand. copyfail is a kernel bug that lets a malicious npm package get root access on your Linux server, right? So now, while there are unpatched servers, is when it would be the perfect time for attackers to target NPM packages. And the advice isn't just "update your kernel" because we are still finding new rela…

NPM supply-chain attacks spread really quickly.

If a popular NPM package was compromised and included a copy.fail exploit, it would make lots of systems vulnerable to root privilege escalation.

Re: Maybe you shouldn't install new software for a bit

#67

Post by tclancy » Fri, May 08, 2026, 1:59 AM UTC

cperciva wrote: post #11

Alternatively, switch to an operating system like FreeBSD which doesn't take a YOLO approach to security. Security fixes don't just get tossed into the FreeBSD kernel without coordination; they go through the FreeBSD security team and we have binary updates (via FreeBSD Update, and via pkgbase for 15.0-RELEASE) published within a couple minutes of the patches hitting the src tree. (Roughly speaking, a few seconds for…

There’s always a guy. It’s great that your favorite distro is definitely safer. An order of magnitude fewer exploits will mean only a few thousand or so, I suppose. Ozymandis used Gentoo.

Re: Maybe you shouldn't install new software for a bit

#68

Post by cybercatgurrl » Fri, May 08, 2026, 2:01 AM UTC

cookiengineer wrote: post #5

Fun fact: You still can't build the vllm container with updated dependencies since llmlite got pwned. Either due to regression bugs, or due to impossible transient dependencies in the dependency tree that are not resolvable. There is just too much slopcode down the line, and too many dependencies relying on pinned outdated (and unpublished) dependencies. I switched to llama.cpp because of that. To me it feels more an…

slopcode is a pejorative that means nothing to me. if you have an actual criticism to make, then do it

Re: Maybe you shouldn't install new software for a bit

#69

Post by xingped » Fri, May 08, 2026, 2:02 AM UTC

tclancy wrote: post #65

marcus_holmes wrote: post #57

This was always a nightmare waiting to happen. The sheer mass of packages and the consequent vast attack surface for supply chain attacks was always a problem that was eventually going to blow up in everyone's face. But it was too convenient. Anyone warning about it or trying to limit the damage was shouted down by people who had no experience of any other way of doing things. "import antigravity" is just too easy to…

So, to play Pandora, what if the net effect of uncovering all these unknown attack vectors is it actually empties the holsters of every national intelligence service around the world? Just an idea I have been playing with. Say it basically cleans up everything and everyone looking for exploits has to start from scratch except “scratch” is now a place where any useful piece of software has been fuzz tested, property t…

TBH this is a pretty good way of looking at it. Yeah we're seeing an explosion of vulnerabilities being found right now, but that (hopefully) means those vulnerabilities are all being cleaned up and we're entering a more hardened era of software. Minus the software packages that are being intentionally put out as exploits, of course. Maybe some might say it's too optimistic and naive, but I think you have a good point.

Re: Maybe you shouldn't install new software for a bit

#70

Post by LeCompteSftware » Fri, May 08, 2026, 2:03 AM UTC

himata4113 wrote: post #44

q3k wrote: post #39

You don't need a kernel LPE to root a Linux developer machine. Just alias sudo to sudo-but-also-keep-password-and-execute-a-payload in ~/.bashrc and wait up to 24 hours. Maybe also simulate some breakage by intercepting other commands and force the user to run 'sudo systemctl' or something sooner rather than later.

this, this is something I don't understand there are a billion ways to gain root once you control the user that regulary uses sudo. this is only scary for rootless containers as it skips an isolation layer, but we've started shipping distroless containers which are not vulnerable to this due to the fact that they lack priviledge escalation commands such as su or sudo. never trust software to begin with, sandbox every…

I agree that de facto the biggest security flaw in Linux is "okay I'm tired of getting interrupted all day assisting you, I know you're competent, I'll put you on the sudoers list."

But there are a lot of academic and research institutions that actually do have good Linux user management. I worked at a pediatric hospital, and the RHEL HPC admins did not mess around in terms of who was allowed to access which patients' data. As someone who was not an admin, it was a huge pain and it should have been. So this bug has pretty serious implications, seems like anyone at that hospital can abscond with a lot of deidentified data. [research HPC not as sensitive as the clinical stuff, which I think was all Windows Server]