4 ms·

One of the more frustrating things about infosec is that more and more practices that were once considered bad or malicious later become mainstream. Used to be

One of the more frustrating things about infosec is that more and more practices that were once considered bad or malicious later become mainstream. Used to be, don't publish information about yourself that could be used to impersonate you. Then we got Facebook. Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" Telemetry/analytics/arbitrary callbacks used to be shady/questionable and require user consent, now it's standard practice to exfiltrate whatever you want from user devices. You've got root/elevated privilege, encryption is easy and your traffic can easily blend into the haystack, so why not. Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout. Seeing traffic from anonymous VPNs logging into financial accounts used to be an obvious giveaway of something suspicious going on. Devices are now shipping with easy-to-enable "anonymous mode" apps that average users have no legitimate need for and route all of your device's traffic through god knows where, which has the effect of making your traffic indistinguishable from a fraudster's. Popular email clients, budget analysis and social media platforms will solicit and cache third-party credentials for your employer, your bank, or your life if you provide them. This despite a decade of trying to beat "never give your password to anyone!" into the popular mindset. Same with algorithmically-generated domains/subdomains, etc.

deleted 7y ago
[deleted]
heresie-dabord 7y ago
> infosec It isn't the rise of fascism -- it's the rise of hyper-profiteering. There is too much money to be made from the ignorance of well-conditioned consumers for principle to prevail.
dontbenebby 7y ago
>Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" It's surprising to me how rarely even reputable companies provide hashes/signatures. I just downloaded a Windows virtual machine that MS offers for free[1]. No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads. (MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location) I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO. [1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...
- ben_w 7y ago
  I’ve been around long enough to remember when people thought that sort of thing was a particular flaw of closed-source, but Ubuntu is failing in a similar way, as this unfixed bug from 2014 (confirmed and with multiple duplicates) demonstrates: https://bugs.launchpad.net/ubuntu/+bug/1359836 https://bugs.launchpad.net/ubuntu/+bug/1359836 Call me cynical, but this is what I expect to see if a government had ordered them to allow certain forms of interference with the OS. I don’t know enough to eliminate any other possibility, but it certainly smells fishy.
  - dontbenebby 7y ago
    Wait, am I reading this bug correctly: even if I have HTTPS everywhere installed to force the S in errant urls, it would still go over HTTP? Because... "we provide the signatures"? Yikes.
    - SpaceNugget 7y ago
      No you are not. the "bug" is that the download page has a link to an http mirror. If there was a bug where the ubuntu website could force your browser to display https:// https:// and serve content over http without a warning you would have most definitely heard about it before now. As to why most mirrors serve over http, it's for the same reasons presented here: https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
      - ben_w 7y ago
        Is there any clear reason why the checksums are also only available on http domains? One of the duplicate bugs: https://bugs.launchpad.net/ubuntu-website-content/+bug/1534967 https://bugs.launchpad.net/ubuntu-website-content/+bug/15349... I believe your link does not explain why Ubuntu’s .iso files are not on https, as one of its justifications is that APT uses other mechanisms for integrity checking, which doesn’t apply to OS installation disk images.
        7y ago
paulryanrogers 7y ago
> Devices are now shipping with easy-to-enable "anonymous mode" apps that average users have no legitimate need for... I'd argue VPNs are increasingly tablestakes as consumer ISPs adopt darker patterns like tag injection. (Recently discovered this in the wild with my new residential ISP.)
scarface74 7y ago
Used to be, don't publish information about yourself that could be used to impersonate you. Then we got Facebook. With the number of data breaches by credit reporting agencies, Facebook is the least of your worries. Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" With iOS, the amount of damage an untrusted binary can do is extremely limited. Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout. Sleazy billing has been a thing since Columbia House.
TeMPOraL 7y ago
Interesting; the first two points you make sound wrong. It used to be that you got most software via "random binaries"; then, in the late 2000s, it became out of fashion and attention was called to dangers. It used to be, when Internet was new, that people didn't have trouble publishing personal information. Personal SEO was a thing; people optimized what prospective employers would find when googling their surname. Facebook came later, and even later still we got calls to stop publishing personal information.
kerng 7y ago
Reminds me of that one time when Microsoft in late 90s sent one web request back to Redmond for Windows installations and all hell broke loose! Microsoft is tracking/controlling everyone and could update things centrally - total world domination is the goal! Then came Google and everyone just surrendered their stuff voluntarily anyway. I think sometimes the player just changes, and then users and media accepts the new reality.

deleted 7y ago

[deleted]

heresie-dabord 7y ago

> infosec It isn't the rise of fascism -- it's the rise of hyper-profiteering. There is too much money to be made from the ignorance of well-conditioned consumers for principle to prevail.

dontbenebby 7y ago

>Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" It's surprising to me how rarely even reputable companies provide hashes/signatures. I just downloaded a Windows virtual machine that MS offers for free[1]. No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads. (MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location) I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO. [1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...

ben_w 7y ago
I’ve been around long enough to remember when people thought that sort of thing was a particular flaw of closed-source, but Ubuntu is failing in a similar way, as this unfixed bug from 2014 (confirmed and with multiple duplicates) demonstrates: https://bugs.launchpad.net/ubuntu/+bug/1359836 https://bugs.launchpad.net/ubuntu/+bug/1359836 Call me cynical, but this is what I expect to see if a government had ordered them to allow certain forms of interference with the OS. I don’t know enough to eliminate any other possibility, but it certainly smells fishy.
- dontbenebby 7y ago
  Wait, am I reading this bug correctly: even if I have HTTPS everywhere installed to force the S in errant urls, it would still go over HTTP? Because... "we provide the signatures"? Yikes.
  - SpaceNugget 7y ago
    No you are not. the "bug" is that the download page has a link to an http mirror. If there was a bug where the ubuntu website could force your browser to display https:// https:// and serve content over http without a warning you would have most definitely heard about it before now. As to why most mirrors serve over http, it's for the same reasons presented here: https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
    - ben_w 7y ago
      Is there any clear reason why the checksums are also only available on http domains? One of the duplicate bugs: https://bugs.launchpad.net/ubuntu-website-content/+bug/1534967 https://bugs.launchpad.net/ubuntu-website-content/+bug/15349... I believe your link does not explain why Ubuntu’s .iso files are not on https, as one of its justifications is that APT uses other mechanisms for integrity checking, which doesn’t apply to OS installation disk images.
      - 7y ago

paulryanrogers 7y ago

> Devices are now shipping with easy-to-enable "anonymous mode" apps that average users have no legitimate need for... I'd argue VPNs are increasingly tablestakes as consumer ISPs adopt darker patterns like tag injection. (Recently discovered this in the wild with my new residential ISP.)

scarface74 7y ago

Used to be, don't publish information about yourself that could be used to impersonate you. Then we got Facebook. With the number of data breaches by credit reporting agencies, Facebook is the least of your worries. Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" With iOS, the amount of damage an untrusted binary can do is extremely limited. Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout. Sleazy billing has been a thing since Columbia House.

TeMPOraL 7y ago

Interesting; the first two points you make sound wrong. It used to be that you got most software via "random binaries"; then, in the late 2000s, it became out of fashion and attention was called to dangers. It used to be, when Internet was new, that people didn't have trouble publishing personal information. Personal SEO was a thing; people optimized what prospective employers would find when googling their surname. Facebook came later, and even later still we got calls to stop publishing personal information.

kerng 7y ago

Reminds me of that one time when Microsoft in late 90s sent one web request back to Redmond for Windows installations and all hell broke loose! Microsoft is tracking/controlling everyone and could update things centrally - total world domination is the goal! Then came Google and everyone just surrendered their stuff voluntarily anyway. I think sometimes the player just changes, and then users and media accepts the new reality.