111–118 of 118 posts
Earlier quoted context omitted.
It's entirely possible to ship malware in source form... Just look at the numerous supply chain attacks. Nix is a cute project but entirely irrelevant here.
It is possible but visible, and it means burning an identity, so it's not irrelevant
I wouldn't consider either of them to burn an identity.
Earlier quoted context omitted.
Windows has this thing called digital signing with certificates that Linux users like to pretend doesn't exist or in the case of yesterday's Wireguard / VeraCrypt discussion, think it's an evil capitalist scheme to control the world. Digital signing on Windows predates Mac developer certificates by years but arguably wasn't widely used outside of security-paranoid organizations. Before someone says Linux offers GPG s…
> Before someone says Linux offers GPG signing it's mostly useless without a central PKI One could also argue that GPG signing is useful exactly because it doesn't rely on a central PKI.
Earlier quoted context omitted.
I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?
I don't know about other managers, but nixpkgs has hashes of the package I'm installing, and is a git repo, so I can easily detect a history rewrite, and I have the full history of package changes over time. Since it's a git repo, I can also easily install things as of a given time.
"Bug fixes and general improvements." Supply chain attacks are easier because changelogs for most software are useless now if they are provided at all.
One interesting thing about all this stuff is that we may see a big swing towards paid/trusted solutions for all these type of things. Maybe the 5-10% of true nerds will go find the l33t open source solutions, but most people will just use some paid solution. Maybe Steam could build. Or in Windows. Or some SaaS solution for registry. In exchange you just share your HW info
Earlier quoted context omitted.
Software is the one thing I won't pirate since the risk of installing malware is extremely high. For media files, unless you are incredibly unlucky and someone is exploiting a bug in the media player, you are entirely safe. But for software you have no way of knowing how the software has been tampered with, and often there actually is malware in it.
Same. I used to pirate software but even way back I kept it limited to very popular software and established downloads (where if they were malware they were almost certain to be in a signature database by that point). And I absolutely never pirated an OS. I thought anyone doing that was out of their freaking mind because any malware there had ultimate access to block its own detection and do whatever else it pleased.…
Earlier quoted context omitted.
I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo... This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will…
I mean this is by design? It makes pirates more likely to get malware, and thus normal people more likely to pay for MS products rather than pirate? You may think its immoral but the incentives line up.
Earlier quoted context omitted.
I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo... This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will…
Software is the one thing I won't pirate since the risk of installing malware is extremely high. For media files, unless you are incredibly unlucky and someone is exploiting a bug in the media player, you are entirely safe. But for software you have no way of knowing how the software has been tampered with, and often there actually is malware in it.