Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dotfiles feel too personal to share

hamatti.org

Post reply on HN
Print view View original

131–140 of 153 posts

Re: Dotfiles feel too personal to share

#131

Post by lrvick »

hnfong wrote: post #124
lrvick wrote: post #109

Earlier quoted context omitted.

It is absolutely not alarmist. Seriously, go apply to be a Homebrew developer right now under an alias, make some useful updates for a few months, then submit a PR as another alias, and approve and merge your own changes from the first alias. After you get away with skipping code review a few times, now go switch a popular package that relies on abandoned sources to point to your fork that makes a few legitimate upda…

> Seen these attacks in the wild many times, some at close range. Not skeptical, just curious - do you have like a list of publicly reported incidents out there that we can read to ourselves during bedtime and maybe scare ourselves into changing our habits?

See my other comment here: https://news.ycombinator.com/item?id=44816971

Re: Dotfiles feel too personal to share

#132

Post by [deleted] »

m463 wrote: post #95
VirusNewbie wrote: post #86

Earlier quoted context omitted.

dotfiles are pretty easy to move to a new server, no?

no. simple but complicated. does the same .bash_profile/.bashrc work on different linux versions? what about macos? and now macos no longer uses bash. And what about saving .bash_history? and on and on. there is a whole industry of shell scripts that try to help with this.

[deleted]

Re: Dotfiles feel too personal to share

#133

Post by sturob »

lrvick wrote: post #129
sturob wrote: post #119

Earlier quoted context omitted.

Could you clarify what you mean by 'attacks like this happen every day' please?

Here are just a few old well known examples in popular package managers: * Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d... * Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00... * NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-pac... * PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_... * Ubuntu Snap: https://github.com/canonical-websites/sna…

Thank you, I was not aware of all of these, and I don't doubt the seriousness of the issue.

That said: 'every day' does seem quite hyperbolic.

Re: Dotfiles feel too personal to share

#134

Post by lrvick »

sturob wrote: post #133
lrvick wrote: post #129

Earlier quoted context omitted.

Here are just a few old well known examples in popular package managers: * Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d... * Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00... * NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-pac... * PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_... * Ubuntu Snap: https://github.com/canonical-websites/sna…

Thank you, I was not aware of all of these, and I don't doubt the seriousness of the issue. That said: 'every day' does seem quite hyperbolic.

There are several thousand expired email domains of maintainers right now on NPM alone, allowing you to easily take over their accounts if you wanted, arguably legally, for maybe $10. I bought the domain name of the sole maintainer of the NPM package "foreach", gaining control of their email address and likely password reset capabilities, just to prove this point and troll the press a bit, which worked better than I could have ever hoped. And yet, still not -enough- press because almost no one is doing anything about it yet.

With easily over a million published open source packages that exist, and it being -so- easy to take them over since almost no one uses hardware code signing or 2FA, and with well above 365 documented/discovered cases every year, (obviously not counting all the ones that are -not- discovered!) "every day" is a given.

If anything with LLM based pull request attacks spiking right now, I assume several malicious commits will be merged today. Most will look like accidents, hard to spot, and merged helpfully by bots that automatically merge commits to major distros. The floodgates are wide open.

"Sonatype logged over 245,032 malicious packages in open source projects available to public download in 2023, double the number seen from 2019 to 2022. In total, one in eight open source downloads poses a risk."

https://www.cpomagazine.com/cyber-security/open-source-softw...

Re: Dotfiles feel too personal to share

#135

Post by theshrike79 »

treve wrote: post #70
justonceokay wrote: post #61

Earlier quoted context omitted.

It completely depends on your work environment. My experience has been doing a lot of admin work and working with distributed databases. I probably spend a third of my day in servers that are not mine. So for me it just doesn’t make sense to make a lot of configuration changes, especially changes that will end up in my muscle memory. Now my personal computer does have much nicer color schemes and a few plugins for co…

Seems like a great opportunity to learn a bit about automating this set up. Really not hard to upload a .vim directory on a remote server for example.

"treve uploaded WHAT on the Big Bank's server?!"

Yeaah, that don't fly unless you're in a really seat-of-your-pants environment. =)

Re: Dotfiles feel too personal to share

#136

Post by theshrike79 »

bshacklett wrote: post #87
treve wrote: post #70

Earlier quoted context omitted.

Seems like a great opportunity to learn a bit about automating this set up. Really not hard to upload a .vim directory on a remote server for example.

The better place to spend time might be the automation of operational tasks on those servers so that logging in isn’t necessary in the first place. Then you don’t have to leave your home environment and you can run whatever custom editing configuration you want. Of course the other upsides to that automation overshadow this a bit.

I'm of the opinion that if you need to log in to a server you've already failed.

Nobody should be ABLE to log in to servers by default, that's the way they become unicorns and not cattle.

Re: Dotfiles feel too personal to share

#137

Post by athorax »

tasuki wrote: post #56
athorax wrote: post #4

I feel similarly. For me I know it is because of my rejection sensitive dysphoria. The fear of someone seeing and judging something personal of mine is quite uncomfortable. I don't have the same issue with code I write professionally.

> I don't have the same issue with code I write professionally. Why not?

It is less personal. I am writing code in the same style as the rest of the code base. Its more focused on correctness than my preferences. If someone critiques code in a PR I don't take it personally as it is usually in good faith.

Re: Dotfiles feel too personal to share

#138

Post by sureglymop »

twp wrote: post #83
cipehr wrote: post #2

I feel similarly. For me it’s less about my unique customizations and more about this paranoia of there being something remotely sensitive in my ssh configs or something… the idea of hostnames, ips, domains, etc “leaking” worries me. I use chezmoi to manage my dotfiles, if anyone has any advice on how to handle these worries I am all ears. I would love to share mine, even to just be able to point coworkers at my conf…

chezmoi includes secret scanning from https://gitleaks.io/ by default to catch when you accidentally add a file with a secret in it. To be even more confident, you should add gitleaks as a git hook to your repo however.

How do you automatically set up the hooks, e.g. when you clone the repo on a new computer?

Also, is there a way to automatically edit a chezmoi managed file in the chezmoi directory? I accidentally type stuff like "nvim .bashrc" way too often and then forget I never added the changes to chezmoi. It would be neat if there was a vim plugin or something that just opened the chezmoi file instead if it's managed.

Re: Dotfiles feel too personal to share

#139

Post by deathanatos »

m463 wrote: post #95
VirusNewbie wrote: post #86

Earlier quoted context omitted.

dotfiles are pretty easy to move to a new server, no?

no. simple but complicated. does the same .bash_profile/.bashrc work on different linux versions? what about macos? and now macos no longer uses bash. And what about saving .bash_history? and on and on. there is a whole industry of shell scripts that try to help with this.

> does the same .bash_profile/.bashrc work on different linux versions?

If we weight versions by likelihood of interacting with them, yes, they do.

> what about macos?

I handle macOS as a special case; it is not too difficult. Mostly, macOS boils down to "Get brew, download the GNU tools with brew, alias the commands to the GNU set", mostly because macOS's builtin tools are crap. The real problem is macOS, not the dotfiles, but many employers (including my own) force one to use macOS. It just not as big a special case as you're thinking.

> and now macos no longer uses bash.

… Apple hasn't updated bash in eons. Yeah, the default is now zsh, but I really hope one isn't just bumming along with bash 3.

And it's also reasonably easier to just use zsh everywhere. zsh is basically objectively superior.

> And what about saving .bash_history? and on and on.

Eh, I learn to love the bomb there.

> there is a whole industry of shell scripts that try to help with this.

There's definitely not.

Re: Dotfiles feel too personal to share

#140

Post by AuthAuth »

theshrike79 wrote: post #135
treve wrote: post #70

Earlier quoted context omitted.

Seems like a great opportunity to learn a bit about automating this set up. Really not hard to upload a .vim directory on a remote server for example.

"treve uploaded WHAT on the Big Bank's server?!" Yeaah, that don't fly unless you're in a really seat-of-your-pants environment. =)

"dammit treve installed hyperland and riced the servers again" - sec team probably
Post reply on HN