3 ms·
If you need to run some unvetted software, do so in a locked down virtual machine, or at least run it only with privileges of a very restricted unix user.
by effie 8y ago
If you need to run some unvetted software, do so in a locked down virtual machine, or at least run it only with privileges of a very restricted unix user.
- dTal 8y agoI don't know about you, but I haven't "vetted" any of the software on my machine, in the sense of proving to myself in any strong sense that it's not malicious. I just rely on a loose web of trust and a hefty dose of contextual clues. Piping curl to bash feels dangerous, but it at least equivalent (and probably actually strictly safer) than running ./configure; make on some weird tarball.
- effie 8y agoWe all rely on the clues like is the distributor well known, is the software very interesting to attackers, etc. Piping curl of random url to shell and running configure and make of tarball from random url is dangerous, because you do not know what gets executed. I don't see a difference, it's the same problem. If you have to run those programs, the safest way is to do so on a dedicated "untrusted" computer that has as little access to your data as possible. On your main work machine, rely on vetted software from well known reliable sources, for example your OS distributor.