9 ms·
One thing I always wonder when I see native software posted here: How do you guys handle the security aspect of executing stuff like this on your machines? Sk
by FreeHugs 7y ago
One thing I always wonder when I see native software posted here:
How do you guys handle the security aspect of executing stuff like this on your machines?
Skimming the repo it has about a thousand lines of code and a bunch of dependencies with hundreds of sub-dependencies. Do you read all that code and evaluate the reputation of all dependencies?
Do you execute it in a sandboxed environment?
Do you just hope for the best like in the good old times of the C64?
- jasonvorhe 7y agoWhat computer are you using and which operating system is running on that? Have you read the code?
- interfixus 7y agoWe may semi-trust our package and repo systems. This tool is readily available through AUR on my Arch machine, I see. Or we may go the whole hog and actually have a peek through the source.
- laumars 7y agoAUR are packages that aren't in Arch's repo system. Granted tools like yaourt do make installing AUR packages nearly as easy as pacman but anyone can upload anything to AUR thus you are expected to vet the packages yourself (hence why tools like yaourt repeatedly prompt you to read the build scripts et al before running them).
- interfixus 7y ago> AUR are packages that aren't in Arch's repo system AUR, Arch User Repository. > thus you are expected to vet the packages yourself Obviously, as a long time Arch user I didn't know this.
- psychrometer 7y agoYou emphasized the wrong word. It is the Arch User Repository. > DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.[0] [0] https://aur.archlinux.org https://aur.archlinux.org
- flatroze 7y agoIt's a valid question. It seems to me users tend to trust things which have certain level of popularity and reputation associated with them. I personally prefer to hope for the worst. This way when nothing happens I feel extra lucky, and if bad things do happen, I feel proud of being ready for it.
- sieabahlpark 7y agoThat could be said about nearly everything that you do.
- air7 7y agoI don't. In the age old debate between security and convince I sometimes want the latter and willing to ease on the former. To me being prepared for the worst is not fun. I use reputation of the software creator to manage my risks.
- js4ever 7y agoIt takes 2 commandes to create a new LXC container and ssh into it, then I install the software inside the container
- masklinn 7y agoThat's more secure than running straight on the machine but not completely secure, security was never a core goal of linux containers. You want to run the software properly sandboxed, since linux doesn't have really engineered OS-level solutions (à la Solaris) that means vm e.g. running in qemu, or biting the bullet and switching to qubes.
- Huggernaut 7y agoI think that's an extremely uncharitable view on containers. There has been a massive amount of work put into securing containers for a variety of use cases using both layers available and by adding to the kernel.
- masklinn 7y ago> I think that's an extremely uncharitable view on containers. It's an objective one. > There has been a massive amount of work put into securing containers for a variety of use cases using both layers available and by adding to the kernel. That doesn't change the fact that security was never the primary goal for containers, so secure containers were and are a bunch of tricks, kludges and prayers being built up in the hope that eventually all the holes in the model will be patched. The "Making containers safer"[lwn][hn] talk was literally two days ago. Note how it says safer, not safe. [lwn] https://lwn.net/SubscriberLink/796700/9bc9daa32a8fe499/ https://lwn.net/SubscriberLink/796700/9bc9daa32a8fe499/ [hn] https://news.ycombinator.com/item?id=20764355 https://news.ycombinator.com/item?id=20764355
- pbhjpbhj 7y agoOf course it says safer, if someone tells you something is entirely safe you know they're lying.
- chrisked 7y agoI just clicked on the OP user name first which has the caption Bad boy. Then I read your comment. Now I worry more about the security aspect than before.
- ErrantX 7y agoIts funny how we sometimes think about risk; if the caption was 'good egg' would you be more trusting?
- chrisked 7y agoI’d have a different initial response. Somehow it triggered my brain to think more about security and be on alert. I’m any case this faded away quickly. The mind is beautiful :)
- flatroze 7y agoThere is nothing either girl or boy, but thinking makes it so.
- jolmg 7y agoPeople trust by default and only distrust when they spot a signal that believably correlates with maliciousness. Kind of like how people judge each other based on how they dress.
- mixmastamyk 7y agoI often run new things in a vm with snapshots. When I don’t it’s as a limited user.
- progval 7y ago> Skimming the repo it has about a thousand lines of code and a bunch of dependencies with hundreds of sub-dependencies. Do you read all that code and evaluate the reputation of all dependencies? I usually do a quick check to see if there's any red flag. Like URLs or Base64 blobs. I also try to stay away from programs written in languages whose environment I don't know so I can check if any dependency stands out wrt what the program claims to do. > Do you execute it in a sandboxed environment? Either I run it on an untrusted server, or on my laptop as an unpriviliged user (with no access to X/wayland).
- OJFord 7y agoSome people run ~everything in individual containers, with original commands being aliases for the docker (or whatever) equivalent. I've shunned that assuming it'd be a big slow down, but I do keep meaning to at least try it, uh, after I knock it. (No, containers like anything else aren't and haven't been completely secure all of the time since and forever, but it'd take a more sophisticated - and certainly deliberately malicious - tool to do any damage to your system, or to files you didn't explicitly allow it access to.)
- forgotmypw 7y agoI do all of my development in a VM, which allows me to take snapshots and have a portable GNU workstation that's decoupled from my desktop and hardware. Meanwhile, my desktop remains clean and ready to play media in native environment with good hardware support. I used to think it'd be slow, until I tried it. My computer is 8+ years old, and it works fine. I mostly do text work.
- OJFord 7y agoI used to use a VM (motivation being to run Linux on my locked-down corporate-imaged Macbook) and it was usable, but not as fast it could be if it had free reign over all CPU/RAM. But, at least the way I was doing it, it's not adding any security as discussed here, since you're doing everything in the VM so anything in the VM has access to everything just as if everything on the host anyway.
- forgotmypw 7y agoScripts I run have access to my development environment for a free software project I already keep in a public repo. What they don't have access to is my actual desktop, nor yesterday's snapshot of the VM desktop. It's obviously not as fast as running GNU on bare metal, but it's fast enough for text work.
- AnIdiotOnTheNet 7y ago> it's fast enough for text work. I guess this is where we set the bar in 2019.
- mike-cardwell 7y agoThese are the install instructions the docs say to use: $ git clone https://github.com/Y2Z/monolith.git $ cd monolith $ cargo install These are the ones I used: $ git clone https://github.com/Y2Z/monolith.git $ cd monolith $ sudo docker run --rm -w "$(pwd)" -v "$(pwd):$(pwd)" -u "$(id -u):$(id -g)" rust cargo install That isolated the build process. Similar method to isolate the execution of the built project: $ cd target/release $ sudo docker run --rm -w "$(pwd)" -v "$(pwd):$(pwd)" -u "$(id -u):$(id -g)" rust ./monolith https://www.grepular.com Slightly related: I released a project last night for easily running node applications inside containers: https://gitlab.com/mikecardwell/safernode https://gitlab.com/mikecardwell/safernode - Without even having node or npm installed on the host system, you can still run commands like "npm install" or "npm start" to run node applications safely isolated inside ephemeral containers.
- wolco 7y agoFor someone having trouble with npm and windows 10, the suggestion couldn't come at a better time.
- jolmg 7y agoThough I don't know the specifics, isn't it commonly advised to not rely on docker for secure isolation of potential malware?
- zymhan 7y agoIt's certainly not as secure as a VM, without a lot of safeguards.
- mike-cardwell 7y agoI've heared this too, but as far as I know it's only because there are potential bugs in the container software that allow the malware to escape. To me, this is kind of like saying you should just run stuff as root, because there might be a privelege escalation vulnerability which lets the code run as root anyway. Correct me if I'm wrong. My goal was to make things more secure, not completely secure. Previously, dodgy libs could read (and add) ssh keys into ~/.ssh/, take over my NPM account by fetching ~/.npmrc, grab a copy of my ~/.bitcoin/wallet.dat, and add a keylogger into my ~/.bashrc Now, at least it has to break out of docker first.
- gambler 7y agoThis is a good question. I think you can make it even better by generalizing the problem. How on earth do developers hope to advance general computing forward when simply running programs isn't a solved problem? Most software engineers I know don't run docker on their home PCs. What about people who aren't in IT? Does anyone here even care? The general attitude I see is "plebs don't need to run anything they can't get outside of an app store". It's a horrible attitude. I very much like this quote from Alan Kay: "It doesn't matter what the computer can do, if it can't be learned by billions of people." There is no good technical reason why modern operating systems can't work out some some scheme for sanboxing arbitrary programs by default. It is obviously necessary. I imagine something like "applications" folder where every subfolder automatically becomes an isolated "container". It would have to be designed with security as the primary concern, though; unlike current container solutions.
- skybrian 7y agoEven with decent containers, making software that's good enough for everyone to use is considerably more difficult than making it for yourself and a few friends. It's okay to do things that don't scale at all, and also okay to make a proof of concept and let someone else worry about scaling it up. That said, you might want to look at Chromebooks and the Windows and Mac app stores to see what's going on with containerization beyond mobile. (Also, web browsers.)
- derefr 7y agoBut arbitrary programs are... arbitrary. Especially ones run by software engineers, and especially ones run by software engineers as part of a POSIX-alike “utility bag” ecosystem. Who’s to say that the user’s intent by running the program they just downloaded, isn’t to—say—overwrite a system folder? (Oh, wait, that’s exactly what Homebrew does, with the user’s full intent behind it!) There are tons of attempts to do what you’re talking about. Canonical’s “snaps” are a good example. As well, every OS sandboxes legacy apps by default (because they’re already virtualizing them, and sandboxing something in a virtualization layer is easy.) But none of those solutions really work for the “neat FOSS hack script someone wrote” workflow we’re talking about here, where you build programs from source and run them for their intentional side-effects on your system. You might suggest that there could be a shared sandbox for all the POSIX-like utilities to interoperate in. But what if you’re attempting to use those utilities against your real documents? (For example, a bulk metadata auto-tagging and auto-renaming utility, to get TV episodes from torrents loaded into Plex correctly.) How do you draw the line of what such a program can operate on? AFAICT, you just... can’t. Its whole purpose is to silently automate some task. If it requires constant security prompting, the task isn’t automated.
- iamvik 7y agoLargely agree, but it's hardly OP's fault. In my opinion this is one of the things we get by using 30 year old Operating System and there having been almost no innovation in that field for so long.
- guy-brush 7y agoRelated (the idea of having android-like permissions for desktop linux): https://github.com/open-source-ideas/open-source-ideas/issues/34 https://github.com/open-source-ideas/open-source-ideas/issue...
- sequoia 7y ago> Do you read all that code and evaluate the reputation of all dependencies? Why of course. I do this for every piece of software on my computer, from the device drivers to the OS, I review every patch to firefox & chrome as well. /s Running someone else's software inherently means extending them trust. This objection is especially confusing on a piece of software where you can actually inspect all the source if you like (unlike e.g. device drivers and OS code unless you run Gnu/Linux + all Free drivers, as few but RMS do).
- Inhibit 7y agoYour tongue in cheek points are good. But on that last bit I disagree. Many, many systems run nothing but stock open source kernel drivers under Linux. I daresay home systems with closed drivers are more of an exception. All those VMs in the "cloud".
- Avi-D-coder 7y agoBefore I installed this tool, I checked if the author was a member of any well known organization and since they are not, I skimmed all the code for monolith and any of it's dependency that are not extremely popular, in this case mime-sniffer.
- flatroze 7y agoThat dependency is now gone, thank you for the review