10 ms·

I'm having slight trouble understanding the threat vector this is supposed to be protecting against. If you don't trust a package's install script, why would yo

by pilif 8y ago

I'm having slight trouble understanding the threat vector this is supposed to be protecting against. If you don't trust a package's install script, why would you trust any of the binaries installed by that package? If you're unsure about bugs in a package's install script, why aren't you equally unsure about bugs in the binaries installed by the package. In-fact, install scripts are auditable; third party compiled binaries aren't (at least not easily). I see other advantages in declarative approaches - for example more freedom for debian to change the underlying file system layout, or to give the user some information about what the package is going to change for easier troubleshooting, but I do not see any advantage security-wise.

saurik 8y ago
I mostly agree with you, but it is worth noting that most software is installwd by root but run by some "less privileged" user. That said, I still agree with you, as there is no data of value on any computer I own that is only accessible to root: all of the data that matters is in fact accessible to whatever the least privileged user that is using all of the software on that machine happens to be... on my laptop, that's me and on my database server that is my database. So really there is no difference between running software as root and running it as the "less privileged" user. Like, the idea that I care that Chromium can run software as root is nonsensical: yes, root can modify all of the software not on my computer... to what end? The only thing of value on my computer is in my home directory, owned by me... hell, thanks to a bunch of people who (incorrectly) think they can make their computers safer by running fewer things as root, a ton of executable files are in my home directory thanks to userspace package managers provided by rust and node.js, so you can even modify other software without even having to be root anymore :/. There is simply no security advantage to any of this.
- bluGill 8y ago
  There are a still a handful of multi-user linux systems out there. Chromium as non-root cannot read the other users files when you log into some evil site that knows of a backdoor. (Assuming no other root backdoor) There is one other point: if my OS is sound and my user files are corrupted - well at least I can restore my files from backup without first trying to reinstall my machine. It saves a little effort.
- 08-15 8y ago
  > the "less privileged" user You can have multiple user accounts, they don't need to be associated 1:1 with living people.
- pilif 8y ago
  Also, if a package installed a suid binary, I would still have no recourse nor ability to audit and it would have full root rights. And blanket warning about such packages would lead to a slew of false positives and warning fatigue (heck, even ping needs to be suid root)
deleted 8y ago
[deleted]

by pilif 8y ago

saurik 8y ago

I mostly agree with you, but it is worth noting that most software is installwd by root but run by some "less privileged" user. That said, I still agree with you, as there is no data of value on any computer I own that is only accessible to root: all of the data that matters is in fact accessible to whatever the least privileged user that is using all of the software on that machine happens to be... on my laptop, that's me and on my database server that is my database. So really there is no difference between running software as root and running it as the "less privileged" user. Like, the idea that I care that Chromium can run software as root is nonsensical: yes, root can modify all of the software not on my computer... to what end? The only thing of value on my computer is in my home directory, owned by me... hell, thanks to a bunch of people who (incorrectly) think they can make their computers safer by running fewer things as root, a ton of executable files are in my home directory thanks to userspace package managers provided by rust and node.js, so you can even modify other software without even having to be root anymore :/. There is simply no security advantage to any of this.

bluGill 8y ago
There are a still a handful of multi-user linux systems out there. Chromium as non-root cannot read the other users files when you log into some evil site that knows of a backdoor. (Assuming no other root backdoor) There is one other point: if my OS is sound and my user files are corrupted - well at least I can restore my files from backup without first trying to reinstall my machine. It saves a little effort.
08-15 8y ago
> the "less privileged" user You can have multiple user accounts, they don't need to be associated 1:1 with living people.
pilif 8y ago
Also, if a package installed a suid binary, I would still have no recourse nor ability to audit and it would have full root rights. And blanket warning about such packages would lead to a slew of false positives and warning fatigue (heck, even ping needs to be suid root)

deleted 8y ago

[deleted]