5 ms·

Running unsigned code from the internet? Have I woken up in crazy land today? When did things like this become acceptable.

p4bl0 11y ago
I had the exact same reaction (and friends over IRC too), but I still find the idea quite cool: it could be implemented correctly (with signature verification or something alike). Also, if it is just to try out a new OS in a virtual machine, I guess it is okay to use such a service :).
- gravypod 11y ago
  Yes, but you would probably want to have a local copy of all public keys for the OSs for verification, it would have to go over HTTPS, and You would likely need some signature validation. The idea is really cool, specifically I'd use this for the raspberry pi. I hope someone does some major security maintenance on this
1ris 11y ago
People are running untrused code all the time. How uses a 100% open source, repoducably build, 100% audited os?
- gravypod 11y ago
  The problem is that this is going over the intenet. If you haven't seen what kind of problems this can cause, you should look at moxie sslstrip talk from defcon. The problem arises when other people want root access to your system and they can now get it from a VERY simple man in the middle. Running untrusted code is one thing, running it after pulling it from the internet is an ENTIRELY different subject.
  - 1ris 11y ago
    All my apt-get downloads go over the internet. All my install isos. People download third party docker contains. I can't see how this is worse.
akerro 11y ago
Run: sh | wget http://www...something.com/install.sh http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.
- tacojuan 11y ago
  docker?
- rplnt 11y ago
  Don't forget that many require you to use sudo.
  - akerro 11y ago
    zsh: command not found: sudo
- bodyfour 11y ago
  No worse than "./configure && make && sudo make install"
  - viraptor 11y ago
    It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc. etc. In theory, yes, `curl | sh` is the same as configure&make is the same as downloading your initial iso image and installing the system from it. In practice they have different risks associated with them.
    - akerro 11y ago
      What about AUR from ArchLinux? It's similar, but it also has different risks, Vidalia/Tor-git maintainers change quite often, users are forced to add new GPG keys, but it downloads src from git (quite often). What about `cd /usr/ports/www/firefox && make clean install`?

p4bl0 11y ago

I had the exact same reaction (and friends over IRC too), but I still find the idea quite cool: it could be implemented correctly (with signature verification or something alike). Also, if it is just to try out a new OS in a virtual machine, I guess it is okay to use such a service :).

gravypod 11y ago
Yes, but you would probably want to have a local copy of all public keys for the OSs for verification, it would have to go over HTTPS, and You would likely need some signature validation. The idea is really cool, specifically I'd use this for the raspberry pi. I hope someone does some major security maintenance on this

1ris 11y ago

People are running untrused code all the time. How uses a 100% open source, repoducably build, 100% audited os?

gravypod 11y ago
The problem is that this is going over the intenet. If you haven't seen what kind of problems this can cause, you should look at moxie sslstrip talk from defcon. The problem arises when other people want root access to your system and they can now get it from a VERY simple man in the middle. Running untrusted code is one thing, running it after pulling it from the internet is an ENTIRELY different subject.
- 1ris 11y ago
  All my apt-get downloads go over the internet. All my install isos. People download third party docker contains. I can't see how this is worse.

akerro 11y ago

Run: sh | wget http://www...something.com/install.sh http://www...something.com/install.sh to install something automatically! Way too many projects do it, from my head: rvm and oh-my-zsh.

tacojuan 11y ago
docker?
rplnt 11y ago
Don't forget that many require you to use sudo.
- akerro 11y ago
  zsh: command not found: sudo
bodyfour 11y ago
No worse than "./configure && make && sudo make install"
- viraptor 11y ago
  It's a bit different though. autoconf/automake is mostly autogenerated and will prevent silly issues like accidental wiping of your drive (https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issues/123 https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...). Released packages will often have hashes either on the website or as additional download. With git you can verify tags (provided they're signed). You can compile&test package inside chroot before installing. Etc. etc. In theory, yes, `curl | sh` is the same as configure&make is the same as downloading your initial iso image and installing the system from it. In practice they have different risks associated with them.
  - akerro 11y ago
    What about AUR from ArchLinux? It's similar, but it also has different risks, Vidalia/Tor-git maintainers change quite often, users are forced to add new GPG keys, but it downloads src from git (quite often). What about `cd /usr/ports/www/firefox && make clean install`?