Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You might want to stop running atop

rachelbythebay.com

Post reply on HN
Print view View original

61–70 of 155 posts

Re: You might want to stop running atop

#61

Post by lionkor »

heavyset_go wrote: post #52
lionkor wrote: post #37

Earlier quoted context omitted.

What about the fact that software is hosted on US/German/Australian/whatever else platforms and infrastructure, what's different with that, technically speaking? The fact that a majority of software we rely on is hosted on GitHub, isn't that scary the same way that a repo owned by someone in a other country is scary? Does a government need to openly act in a specific way for there to be a risk, or is this perceived r…

These are all good questions where the answer is usually something along the lines of solving them with reproducible builds and Nix, which sounds good until someone points out where the Nix ecosystem gets its funding.

Again, what is the issue with funding? If I get funding from the German government, am I more trustworthy than someone who gets funding from the Hungarian government, like, really? Is there a real, tangible risk here that does not exist with other governments?

Of course the US government isn't scary if you're in the US, but not everyone is, and governments change.

I'm asking not whether it feels like there's a risk, I'm asking whether, factually speaking, there is a significant enough risk that outweighs all else. Is there?

Re: You might want to stop running atop

#62

Post by mandmandam »

bigstrat2003 wrote: post #54
plorkyeran wrote: post #17

Earlier quoted context omitted.

Yeah, from a rando this would be just bad vagueposting but Rachel is absolutely someone who could know about a very good reason why we should uninstall atop but be unable to legally say why. I would heed her warning.

I would disagree and still say that this is bad vagueposting. It doesn't matter how reputable the source is: if you say "don't do X" but don't give a reason why, I'm not inclined to listen. Granted I don't use atop anyways, but I don't think a vague blog post - even one from a respected person - is sufficient justification to change what software one uses.

> It doesn't matter how reputable the source is:

It does though.

"Don't go down 6th street now" means very different things depending on whether it comes from your buddy, or the bomb squad.

> if you say "don't do X" but don't give a reason why, I'm not inclined to listen.

I hear ya, but, there are sometimes valid reasons people can't say things; and this may well be one of those times. You have every right to do as you like, but it's not necessarily smart now that you've been warned by a respected professional.

Re: You might want to stop running atop

#64

Post by nodesocket »

bitbasher wrote: post #30

Pure speculation; but it sounds to me like she was doing some sysadmin triage and possibly stumbled onto a backdoor/exfiltration through atop. She likely can't disclose anything right now.

Except, she kinda did disclose already. Seems a bit strange to circumvent standard embargo practices, only to publicly hint of an exploit but not give any details.

Re: You might want to stop running atop

#65

Post by thayne »

crimsonpowder wrote: post #22
ggm wrote: post #5

Earlier quoted context omitted.

I go with three paths out. 1. it consumes too much systems resources. So its net-negative impact on the system under observation 2. it's misleading and leads to false diagnoses of situations under review 3. she's under an NDA of some kind related to a CVE or some other high class risk which will come out in due course but she felt a burden to stop people being exposed to risk. 4. I can't count and there are 4, 5, 6 o…

If it was 1 or 2, there would be a long Rachel-style post ranting about it and explaining exactly why. It has to be 3. And she knows her stuff, so I'm listening. Luckily we don't use atop.

But if it was 3, why not say "I know there is a vulnerability, but I can't share the details"?

I'm not saying it isn't 3, but if it is, it seems like there might be more to it than a run-of-the-mill CVE.

Or maybe she doesn't know of a specific vulnerability/backdoor but has some reason to be suspicious there might be.

Re: You might want to stop running atop

#66

Post by geenat »

protocolture wrote: post #60
geenat wrote: post #21

Probably a backdoor. Repositories controlled by accounts based in mainland China and Russia are always a risk- it's too easy for a dictatorship to force something to happen even if the authors themselves are trying to act in good faith. XZ, Swoole... examples off the top of my head.

> it's too easy for a dictatorship to force something We really need to get rid of this mentality. Australia has laws that allow undisclosed, compelled, software updates. Verbally by ministers, but written (confidential) changes can be requested by federal agencies. Many western countries have followed to various degrees. There's no stable trusted government that doesn't want its fingers in your code.

I agree it's not good but being realistic: I'd be far less worried about the Australian government stealing/selling customer data, using my servers in a botnet, using my servers to spread malware.. etc.

Mainland China, Russia, North Korea, all have proven track records of doing these things and having corporate espionage rat lines: https://www.youtube.com/watch?v=y27B-sKIUHA

Re: You might want to stop running atop

#67

Post by Macha »

LinuxBender wrote: post #53
keyle wrote: post #46

Is atop included in any distributions? Is there even a tool to search what is pre-installed in each major distribution(s)?

"Ubuntu, Debian, Red Hat Enterprise Linux, Fedora, Linux Mint, SUSE Linux Enterprise, CentOS, Manjaro, elementary OS, Gentoo, Oracle Linux, and Pop!_OS" ~--Google's AI. I am not aware of any that install it by default.

Google's AI has just given you a plausible sounding but mostly wrong list of distros - it's not in the enterprise distros, elementary or pop os

Re: You might want to stop running atop

#68

Post by vanc_cefepime »

Linux newbie here. Jumped into the Linux world after getting tired of Microsoft's BS with Win 11. Running Linux mint on my laptop and desktop. Looks like 'atop' is not installed by default, but regular 'top'. Anyone know which distros I should be worried about that have it? Also I have been dabbling with proxmox, I checked and looks like 'top' is the default there too.

Re: You might want to stop running atop

#69

Post by tetromino_ »

geenat wrote: post #21

Probably a backdoor. Repositories controlled by accounts based in mainland China and Russia are always a risk- it's too easy for a dictatorship to force something to happen even if the authors themselves are trying to act in good faith. XZ, Swoole... examples off the top of my head.

Where did you see signs of control by Russia or China? The project's github repo states that the project currently has one maintainer, and that maintainer has a very Dutch name and a .nl website.

Re: You might want to stop running atop

#70

Post by do_not_redeem »

refulgentis wrote: post #43
SubiculumCode wrote: post #38

Earlier quoted context omitted.

Btop variants, glances, why should I move from htop?

Why should I move on from top? (serious question) I'm genuinely stunned to figure out there's a whole set of lore of *tops. I'm not sure I'm being rational from a textbook security perspective, but, it'd take a whole lot of tangible reward to get me off the binaries supplied with the system.

btop gives you a more holistic overview of the system: individual disk stats, network stats, graphs of mem/cpu/bandwidth usage over time, etc.

I think it's handy having everything on one screen, but if you know your way around all the individual builtin tools for these, more power to you, no reason to change.

Post reply on HN