It's Rachel. If she says to remove it, I'll remove it. I see people are suspicious, but I think I'll trust someone like her at least once to do this.
I am out of the loop. Who is Rachel, and what are they famous for?
You might want to stop running atop
111–120 of 155 posts
Re: You might want to stop running atop
#112It's Rachel. If she says to remove it, I'll remove it. I see people are suspicious, but I think I'll trust someone like her at least once to do this.
I am out of the loop. Who is Rachel, and what are they famous for?
She is a known technology blogger https://rachelbythebay.com, active for more than a decade. Her posts often make it to front page.
I'd trust her enough to remove a non-essential component like atop basically.
Re: You might want to stop running atop
#113Earlier quoted context omitted.
Why should I move on from top? (serious question) I'm genuinely stunned to figure out there's a whole set of lore of *tops. I'm not sure I'm being rational from a textbook security perspective, but, it'd take a whole lot of tangible reward to get me off the binaries supplied with the system.
First of all, btop is included in the default repos of most Linux distros, so you don't need to worry about security. This also applies to htop and glances by the way. In terms of tangible feature benefits, btop also offers disk I/O stats, network throughput stats, partition usage, and even GPU usage (if your distro compiled it with GPU support). In terms of "nice" stuff that's non-essential, the overall UI is a lot…
[deleted]
Re: You might want to stop running atop
#114Earlier quoted context omitted.
I would disagree and still say that this is bad vagueposting. It doesn't matter how reputable the source is: if you say "don't do X" but don't give a reason why, I'm not inclined to listen. Granted I don't use atop anyways, but I don't think a vague blog post - even one from a respected person - is sufficient justification to change what software one uses.
This seems completely backwards... if someone says to do something but doesn't give a reason, then the ONLY thing to base your decision on whether to listen is their reputation and your trust in them. If someone I trust tells me to trust them, I will.
First, I decided I am going to avoid atop. Even if Rachel would be wrong, it doesn't hurt not to use some specific software I don't depend on.
> If someone I trust tells me to trust them, I will.
Huh? When I trust someone, then I trust already and there's no need being told to trust. When I don't trust someone, then I run away when being told to trust. Hell, if someone tells me to trust them, it's a red flag and I drop the trust.
Re: You might want to stop running atop
#115There's a bunch of interesting recent commits from someone without a public signing key. Removed excess checks before free() Fixed possible wrong result bit shifting on 64bit after left op type overflow Fixed possible wrong result bit shifting on 64bit after left operand type overflow Fixed possible access out-of-bounds items array better check index before using Could be legit or flawed. Or even fixes for the possib…
1. Unsigned commits is the norm. It's weird to sign git commits. It's weird to upload your gpg key to github. gpg is a nightmare mess. 2. They aren't introducing the bug, those are all unreleased commits, so advice to "uninstall now" for something no distros are shipping would be silly. 3. The diff is trivial, you can read it and figure out if it looks like they're fixing a real exploitable thing. The answer is obvio…
> It's weird to upload your gpg key to github. gpg is a nightmare mess.
I agree on that, but note that you're also able to use your existing SSH key for signing commits. https://docs.github.com/en/authentication/managing-commit-si...
Re: You might want to stop running atop
#116Earlier quoted context omitted.
I would disagree and still say that this is bad vagueposting. It doesn't matter how reputable the source is: if you say "don't do X" but don't give a reason why, I'm not inclined to listen. Granted I don't use atop anyways, but I don't think a vague blog post - even one from a respected person - is sufficient justification to change what software one uses.
[flagged]
Being a system administrator isn't a scientific endeavour where the goal is to seek truth. It's a practical endeavour where the goal is to reduce risk of bad things happening. Sometimes, that means blindly following the advice of reputable people who hint at severe vulnerabilities in a piece of software, even though they can't disclose enough to prove that a vulnerability exists yet.
Keep having atop installed until you get absolute proof that it can be exploited, if that's what you want. But the organization whose systems you're administering might not like the fact that you were forewarned and didn't act.
Re: You might want to stop running atop
#117Earlier quoted context omitted.
Seems like the latest version might be as old as July 2024? https://www.atoptool.nl/allnews.php For anyone interested, here are the latest commits to the GitHub: https://github.com/Atoptool/atop/commits/master/
Skimming through the code (particularly from past issues and PRs) highlights a number of things that look sketchy to me at first glance (in a coding practices way, not in a malicious way) - my gut feeling is that someone smarter than me going through much of this with a fine-toothed-comb would likely find something exploitable. Rewrite it in Rust. /s
> my gut feeling is that someone smarter than me going through much of this with a fine-toothed-comb
Seems that's already started: https://github.com/Atoptool/atop/issues/330
Re: You might want to stop running atop
#118No one else seems to have run 'grep system(', so I will: https://github.com/Atoptool/atop/blob/037a6d3e4ace6c7be6c5dc... > system ("gunzip -c %s > %s", tmpname1, tmpname2") tmpname2 is hardcoded as "/tmp/atopwrkXXXXXX", so that's fine. tmpname1 is '$irawname.gz'. '$irawname' is set by the '-r' flag. So, presumably if you can get the rest of the code to play nice and get you there, you can escalate from having shell a…
Eh? Calling system() for a binary without a path? And why system() using execl() in the first place, when you could do something using execve() without a sh inbetween instead?
Even w/o an exploit this can be prettier and more secure.
Re: You might want to stop running atop
#119Is atop included in any distributions? Is there even a tool to search what is pre-installed in each major distribution(s)?
Check in your available container images:
docker images -q | xargs -I{} -t docker run --rm {} sh -c 'type atop && echo "DANGER!!!"'
I'd be surprised if any large distros shipped it in a stock configuration.
Re: You might want to stop running atop
#120Earlier quoted context omitted.
Google's AI has just given you a plausible sounding but mostly wrong list of distros - it's not in the enterprise distros, elementary or pop os
Missing from their output is an upvote and downvote button. Or a debug function that forces it to divulge where it obtained the data. Wait, now that I think about it why are there Fact Checkers for humans and not for AI?
That sounds like a lot of work, can't we get AI to do it for us?