4 ms·
The one issue I've always had with Hackintosh, is that while the main OS is from Apple it invariably requires using some 3rd party bootloaders, kexts and other
by yumraj 7y ago
The one issue I've always had with Hackintosh, is that while the main OS is from Apple it invariably requires using some 3rd party bootloaders, kexts and other files. And, this to me always raises the issue of security and whether they contain, or can contain, any backdoors/malwares.
Part of it could be my paranioa, but I never got a good answer to satisfy me.
- burtonator 7y agoI put in some malware in kext directly targeting anyone named yumraj. /evilgrin
- the8472 7y agoHow is that all that different from any other software you download? With 100s of dependencies any one of them could be malicious and just wait for the next privilege escalation attack and achieve the same persistence level as a malicious kernel module.
- deleted 7y ago[deleted]
- rwmj 7y agoThe major Linux distros have processes in place to both filter what goes in and handle security issues when they happen. If you have specific concerns then name them, but downloading a Fedora or Debian install is in no way comparable to installing binaries from random filesharing websites.
- the8472 7y agoDo you only run software available in distro packages?
- rwmj 7y agoGiven that I'm a Fedora packager, yes, or else software which I wrote myself.
- la_barba 7y ago>but downloading a Fedora or Debian install is in no way comparable to installing binaries from random filesharing websites. What if you download binaries from non-random, trusted websites? Seem to me that is the same as trusting a repo maintainer.
- rwmj 7y agoYou omitted where I said distros "have processes in place". We can discuss whether the processes are adequate, but the situation itself is completely different from downloading binaries from websites, trusted or otherwise.
- la_barba 7y agoI don't think its "completely different". Its only a minor difference in my view. We'll just have to agree to disagree. IMO repository maintainers are not going to code review every patch in every package, and logistically they can't anyway. The only 'process' here AFAICT, is to take down the patch once news spreads of a bad patch.
- neilv 7y agoMost of the alternative Android distros/builds (other than for devices supported by LineageOS at the moment) have similar provenance problems, in my experience with many devices: XDA-developers usually told me to just download and run/install these binaries from some strange file-sharing site. Not only is that highly questionable practice, but it seems to relieve much of the demand for more reasonable solutions. Which is one of the reasons I'm hoping PostmarketOS takes off -- a lot of the sketchiness potential has been removed.
- wtallis 7y agoThis tends to also apply to OpenWRT vs almost all other third-party router firmware distributions. But at least for router distros, some of the maintainers of custom builds earn a fairly solid reputation and eventually build a project that approaches the degree of organization that's typical for desktop Linux distros. I think phone OS distros have to change targets too often the really get there.
- neilv 7y agoGood point. The Linux ecosystem is much more amenable to that than chasing whatever Android does. Also, the popular home router hardware is more amenable than most handhelds (which often locked bootloaders, signed images, and lots of unsustainable closed drivers).
- yumraj 7y agoFor my DD-WRT build I struggled in a similar way, since a compromised router can do a lot of damage. In the end it seemed "kong" had a good reputation and decided to get his/her build, but it wasn't an easy decision.
- ryuukk_ 7y agothey are all open source, you can build them yourself but again, you are lazy, so why you even care ?