5 ms·

> How does the bad guy get a foot in the door? If you were using Ubuntu Linux in 2007-2008 you will remember the compiz/beryl craze. Everybody and their dog wa

by znpy 7y ago

> How does the bad guy get a foot in the door? If you were using Ubuntu Linux in 2007-2008 you will remember the compiz/beryl craze. Everybody and their dog wanted the latest version of compiz. Adding random repositories was not a problem if that got you the latest version of compiz/beryl. Until a guy, one of the maintainers of a popular repository, tricked everybody: in the install scripts he added code to change the desktop background to an image with a text reading: don't add random repositories from the internet. Think about all the random repositories and PPAs that people add to their systems without thinking. That is an example of how you get a foot in the door.

pdonis 7y ago
> Think about all the random repositories and PPAs that people add to their systems without thinking. This doesn't seem like a "desktop Linux security" problem. It seems like a "some users do dumb things" problem. You can't fix that with an OS. But I can "fix" it easily by not adding random repositories and PPAs.
- ironmagma 7y ago
  Lots of security issues are fixed not by “fixing” them but by adding mitigations which include user approval, surfacing otherwise hidden activity, and other crutches. At the end of the day it is an automated system and must do things without the human in the loop, so the best you can do is make “the loop” visible to the user.
  - pdonis 7y ago
    > user approval Adding a repository/PPA does require user approval. You can't do sudo without knowing you're doing it. > surfacing otherwise hidden activity Yes, and Linux gives you plenty of tools to do that, like, say, "ps aux" and "top" (or the many GUI equivalents in various desktop environments). > At the end of the day it is an automated system Remember we're talking about desktops here, not servers. Desktops are not "automated" in any relevant sense for this discussion.
- angry_octet 7y ago
  Agree that isn't a great example. Linux package repos are still far in advance of the mish mash of stores and direct install that is Windows and MacOS. Programs like Thunderbird and every Gnome program with an embedded web browser are a bit problem. It's really hard to prevent random web stuff from happening on your box, and I don't want anything except a fully patched Chrome/Chromium or Firefox talking http(s) to anything unless it is audited, isolated and constrained to do a small number of tasks. Office suites and file viewers are ripe for exploits. I'd argue that open office has an essentially unlimited supply. PDF readers ... Ugh. Even simple image tools have occasional oopses. Confining the small Linux tools that do simple things is actually a good match for containment technology; where it fails is big complex GUIs like office suites, or tools that need broad file system access and network comms. If Linux had any standards for the file dialogue it would be much simpler to retrofit access controls. Even Android is so far in advance of desktop Linux it is hard to see the catch-up happen. I almost can't believe that desktop linuxes still don't support running Android apps.
  - pdonis 7y ago
    > Programs like Thunderbird and every Gnome program with an embedded web browser are a bit problem. Yes, which is why I don't use any of them. > It's really hard to prevent random web stuff from happening on your box No, it isn't. You simply don't run programs that aren't trustworthy. If you want to know what network activity your programs are doing, that's what "netstat" is for. > Office suites and file viewers are ripe for exploits. Yes, which is why I don't use them except in particular cases (open source PDF viewers are generally OK, and for the times when I'm forced to open an office document, LibreOffice has good defaults for not running embedded macros or resolving embedded links). > I almost can't believe that desktop linuxes still don't support running Android apps. These people seem to be taking a stab at it: https://anbox.io/ https://anbox.io/ In any case, the divergence here is due to Android, not desktop Linux; Google deliberately made Android enough of a "not Linux" to make its apps incompatible with desktop Linux.
    - angry_octet 7y ago
      I would like to have per-application egress control on linux without containerising everything myself or writing baroque filtering that is undebuggable. I shouldn't need to trust every line of code in some massive package just to run it safely -- and I shouldn't have to tcpdump it to see what it is doing on the network.
- deleted 7y ago
  [deleted]
- danieldk 7y ago
  This doesn't seem like a "desktop Linux security" problem. It is a desktop Linux security problem, because people will want to install applications that are not available in a distribution. So, you should provide a mechanism to let them do that relatively securely.
eth0up 7y ago
I once discovered a botnet running on my Ubuntu system. I always assumed a PPA the culprit. The ip addresses were gazprom, some stuff in China, a ton of others, etc - too long ago to remember details. I also remember when I first started with Arch, which at that time had unsigned packages. Edit: comment truncated by sleeping aid. I've gone dumb, but also remember the router suffering too, even after a hard reset, westell, I think.
- danieldk 7y ago
  I also remember when I first started with Arch, which at that time had unsigned packages. Very much at the urging of Arch maintainers not to, people are using package managers to install stuff from AUR, where literally anyone can upload PKGBUILDs. Another easy vector (for developers) are language package managers. E.g. Rust's Cargo runs build scripts (small Rust programs for configuration) for many crates, unsandboxed.
mrtweetyhack 7y ago
You assume even officials repositories are secure, they are not.

by znpy 7y ago

pdonis 7y ago

> Think about all the random repositories and PPAs that people add to their systems without thinking. This doesn't seem like a "desktop Linux security" problem. It seems like a "some users do dumb things" problem. You can't fix that with an OS. But I can "fix" it easily by not adding random repositories and PPAs.

ironmagma 7y ago
Lots of security issues are fixed not by “fixing” them but by adding mitigations which include user approval, surfacing otherwise hidden activity, and other crutches. At the end of the day it is an automated system and must do things without the human in the loop, so the best you can do is make “the loop” visible to the user.
- pdonis 7y ago
  > user approval Adding a repository/PPA does require user approval. You can't do sudo without knowing you're doing it. > surfacing otherwise hidden activity Yes, and Linux gives you plenty of tools to do that, like, say, "ps aux" and "top" (or the many GUI equivalents in various desktop environments). > At the end of the day it is an automated system Remember we're talking about desktops here, not servers. Desktops are not "automated" in any relevant sense for this discussion.
angry_octet 7y ago
Agree that isn't a great example. Linux package repos are still far in advance of the mish mash of stores and direct install that is Windows and MacOS. Programs like Thunderbird and every Gnome program with an embedded web browser are a bit problem. It's really hard to prevent random web stuff from happening on your box, and I don't want anything except a fully patched Chrome/Chromium or Firefox talking http(s) to anything unless it is audited, isolated and constrained to do a small number of tasks. Office suites and file viewers are ripe for exploits. I'd argue that open office has an essentially unlimited supply. PDF readers ... Ugh. Even simple image tools have occasional oopses. Confining the small Linux tools that do simple things is actually a good match for containment technology; where it fails is big complex GUIs like office suites, or tools that need broad file system access and network comms. If Linux had any standards for the file dialogue it would be much simpler to retrofit access controls. Even Android is so far in advance of desktop Linux it is hard to see the catch-up happen. I almost can't believe that desktop linuxes still don't support running Android apps.
- pdonis 7y ago
  > Programs like Thunderbird and every Gnome program with an embedded web browser are a bit problem. Yes, which is why I don't use any of them. > It's really hard to prevent random web stuff from happening on your box No, it isn't. You simply don't run programs that aren't trustworthy. If you want to know what network activity your programs are doing, that's what "netstat" is for. > Office suites and file viewers are ripe for exploits. Yes, which is why I don't use them except in particular cases (open source PDF viewers are generally OK, and for the times when I'm forced to open an office document, LibreOffice has good defaults for not running embedded macros or resolving embedded links). > I almost can't believe that desktop linuxes still don't support running Android apps. These people seem to be taking a stab at it: https://anbox.io/ https://anbox.io/ In any case, the divergence here is due to Android, not desktop Linux; Google deliberately made Android enough of a "not Linux" to make its apps incompatible with desktop Linux.
  - angry_octet 7y ago
    I would like to have per-application egress control on linux without containerising everything myself or writing baroque filtering that is undebuggable. I shouldn't need to trust every line of code in some massive package just to run it safely -- and I shouldn't have to tcpdump it to see what it is doing on the network.
deleted 7y ago
[deleted]
danieldk 7y ago
This doesn't seem like a "desktop Linux security" problem. It is a desktop Linux security problem, because people will want to install applications that are not available in a distribution. So, you should provide a mechanism to let them do that relatively securely.

eth0up 7y ago

I once discovered a botnet running on my Ubuntu system. I always assumed a PPA the culprit. The ip addresses were gazprom, some stuff in China, a ton of others, etc - too long ago to remember details. I also remember when I first started with Arch, which at that time had unsigned packages. Edit: comment truncated by sleeping aid. I've gone dumb, but also remember the router suffering too, even after a hard reset, westell, I think.

danieldk 7y ago
I also remember when I first started with Arch, which at that time had unsigned packages. Very much at the urging of Arch maintainers not to, people are using package managers to install stuff from AUR, where literally anyone can upload PKGBUILDs. Another easy vector (for developers) are language package managers. E.g. Rust's Cargo runs build scripts (small Rust programs for configuration) for many crates, unsandboxed.

mrtweetyhack 7y ago

You assume even officials repositories are secure, they are not.