4 ms·

>I don’t understand how people dare to run executables downloaded from a pirate site... But do you understand people who dare to run executables from 'proper-c

>I don’t understand how people dare to run executables downloaded from a pirate site... But do you understand people who dare to run executables from 'proper-company' site? It's closed source, you have no idea what you are running, isn't it? As long as it's not free software in terms of FSF there is not guarantee what so ever that it's not harmful or even worse intentionally harmful. How about this one from SONY, that didn't even ask user to run? https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... or this one Amazon remotely deletes book from kindle: https://www.nytimes.com/2009/07/18/technology/companies/18amazon.html https://www.nytimes.com/2009/07/18/technology/companies/18am...

raesene9 6y ago
There's no guarantees what you're getting even if it's open source, unless you read and understand the source code :) The set of computer users who a) have the knowledge to do security code review and b) have the time to review the programs they run is, I would expect, fairly small.
- maayank 6y ago
  > There's no guarantees what you're getting even if it's open source, unless you read and understand the source code :) Obligatory reference to Reflections on trusting trust [1] [1] https://dl.acm.org/doi/10.1145/358198.358210 https://dl.acm.org/doi/10.1145/358198.358210
- lovelyviking 6y ago
  >The set of computer users who a) have the knowledge to do security code review and b) have the time to review the programs they run is, I would expect, fairly small. Even a small number of those who understands can make a huge noise, because if comment is well grounded, it spreads exponentially by people who do not need to understand all the details. And frankly how much those who understand you really need for each project? The thing is, if you are worried you can always look, which is not the case if you have nowhere to look. Also expert is not always required just to see there is no brutal obvious harm intent, which covers a lot of cases
  - raesene9 6y ago
    There are a number of cases, even with just bugs, which won't be deliberately hidden (unlike malicious software) where critical security issues have gone unnoticed in major open source software packages for year (e.g. shellshock). Then you have the fact that if it's deliberately malicious things can be hidden such that even experienced code reviewers (who are not plentiful) could be fooled. A good example of this is the underhanded C contest http://www.underhanded-c.org/_page_id_2.html http://www.underhanded-c.org/_page_id_2.html . Sure an open source user may catch malicious behaviour, but then security researchers find malicious behaviour in closed source software pretty regularly via reverse engineering or binary analysis. This isn't an anti-open source thing, it's a reflection that open source often isn't much of a signal of safety, unless further work has been done and continues to be done on a regular basis.
hengheng 6y ago
Still a reputation to lose, generally speaking. I have also never seen anybody who made this argument verify their free software by looking at sources before compiling.
- cpach 6y ago
  Exactly. Even if I would use only 100% FOSS software, I would not have the time to read all the source code of the whole stack, from the device drivers to the kernel and up to the source code of the web browser, etc etc.
enzo1982 6y ago
> But do you understand people who dare to run executables from 'proper-company' site? It's closed source, you have no idea what you are running, isn't it? As long as it's not free software in terms of FSF there is not guarantee what so ever that it's not harmful or even worse intentionally harmful. You'll have to trust somebody at some point. Do you trust the company who designed your Ethernet chip? Do you trust the person who wrote the firmware for it? If not, go and design your own network chip. Otherwise, there's no guarantee it won't spy on you. You'll also want to write your own compiler that you'll then use to build the operating system you intend to run. You won't just go download some Linux .iso to install, would you? After all, there's no guarantee it's not been manipulated by those who offer it on their website.
- lovelyviking 6y ago
  >You'll have to trust somebody at some point. No, I do not have to. I can choose to, but I don't have to! That is the core of the issue.If I 'have to' then I don't. I prefer checking and facts, not delusions. >Do you trust the company who designed your Ethernet chip? No, I don't and we shouldn't. I evaluate chances and we should track network activity with diff. hardware on diff. chipsets from diff. manufacturers. >Do you trust the person who wrote the firmware for it? No, I don't and we shouldn't as it's insane to do so. >If not, go and design your own network chip. There are other means to overcome this: encryption. But yes, you right, we should make open source network chip. Agree. I certainly plan to design it. >Otherwise, there's no guarantee it won't spy on you. That is correct, I agree with you. >You'll also want to write your own compiler. Yes, that is correct. I want and I am writing it right now. There is also an option of GNU c/c++ compiler available (GCC) https://gcc.gnu.org https://gcc.gnu.org >that you'll then use to build the operating system you intend to run. This is how you build a proper GNU/Linux system worth some degree of your trust. >You won't just go download some Linux .iso to install, would you? After all, there's no guarantee it's not been manipulated by those who offer it on their website. Exactly. Or it can be modified on the way, while you download it. For the later you can check hash sums published by a site who respects user freedom and cares about own reputation. >You'll have to trust somebody at some point. Again I do not have to, but I can choose to trust with some degree to Richard Stallman and people sharing his views. https://www.youtube.com/watch?v=n9YDz-Iwgyw https://www.youtube.com/watch?v=n9YDz-Iwgyw I have some trouble trusting FSF since he was removed from the position due to false accusations for saying (!) just saying things, which he actually didn't say if you read carefully. Speak about respect of freedom of speech. https://www.youtube.com/watch?v=7UbQ1kc1vQU https://www.youtube.com/watch?v=7UbQ1kc1vQU To trust the system we should have trust worthy components with open sourced designs starting from CPU and every chip installed and ending with each software running. That is the only way!
black_puppydog 6y ago
With companies, there's an incentive structure that usually makes it pretty obvious whether they have an interest to do really shady stuff on your PC. For "proper" companies that have established customer bases and a legit revenue model, they have an incentive to not screw everyone over and lose their trust. That's just good management. Of course, management often screws this up and then we get (justifiably) outraged HN posts. For pirated software the incentive structures are also clear, and usually point towards "yeah if given the chance they'll take everything from my HDD and make a run for it." I'm all for FOSS everything, but running a company-distributed binaries is very different from pirated ones, and I agree with GP that it baffles me someone would do the latter.
- lovelyviking 6y ago
  >For "proper" companies that have established customer bases and a legit revenue model, they have an incentive to not screw everyone over and lose their trust. It also depends on what company means by "not screw everyone over" Right now many companies consider practices as 'OK' while I am coming from the times when most of those modern activities considered to be virus or malware. So for me it doesn't really matter whether you have malware installed by a virus or it's hidden deeply in EULA which you can't reject partially anyway.
  - black_puppydog 6y ago
    Oh I'm not trying to defend these practices in the least. But at least there is some mechanism (public outrage) there to make them think about it. That these mechanisms seem to fail and we need proper regulation is a different matter. Also in a lot of cases it's not really clear which tangible monetary benefit companies get from spying on their customers. Many cases seem to be managerial paranoia (Just in case the customers pirate!) or "because we can." Pirating and re-packaging software for torrent is also a non-negligible amount of work, and with no revenue stream besides bundling the apps with malware. So it's quite a different incentive structure still.
gjs278 6y ago
and neither of those are ransomware. do you understand the difference?
- lovelyviking 6y ago
  >do you understand the difference? Let's take a File System for a second as example. If you wrote your personal data on some disk drive and then to read this drive you need let's say Mac/Win because it's a closed format. And Mac/Win cost money. How it differs from ransomware then? Sure you have more time to decide, usually more than 3 days and it costs a bit less, but is it much of a difference there? Probaly a choice to start using it, but is it really a choice? In many cases it's not really. So back to your point, I understand it, but do you?
  - gjs278 6y ago
    so no, you don’t. the sony root kit did not ransomware your data. your new example is also 100x less harmful than encrypting your data for ransom. you’re grasping at straws.

raesene9 6y ago

There's no guarantees what you're getting even if it's open source, unless you read and understand the source code :) The set of computer users who a) have the knowledge to do security code review and b) have the time to review the programs they run is, I would expect, fairly small.

maayank 6y ago
> There's no guarantees what you're getting even if it's open source, unless you read and understand the source code :) Obligatory reference to Reflections on trusting trust [1] [1] https://dl.acm.org/doi/10.1145/358198.358210 https://dl.acm.org/doi/10.1145/358198.358210
lovelyviking 6y ago
>The set of computer users who a) have the knowledge to do security code review and b) have the time to review the programs they run is, I would expect, fairly small. Even a small number of those who understands can make a huge noise, because if comment is well grounded, it spreads exponentially by people who do not need to understand all the details. And frankly how much those who understand you really need for each project? The thing is, if you are worried you can always look, which is not the case if you have nowhere to look. Also expert is not always required just to see there is no brutal obvious harm intent, which covers a lot of cases
- raesene9 6y ago
  There are a number of cases, even with just bugs, which won't be deliberately hidden (unlike malicious software) where critical security issues have gone unnoticed in major open source software packages for year (e.g. shellshock). Then you have the fact that if it's deliberately malicious things can be hidden such that even experienced code reviewers (who are not plentiful) could be fooled. A good example of this is the underhanded C contest http://www.underhanded-c.org/_page_id_2.html http://www.underhanded-c.org/_page_id_2.html . Sure an open source user may catch malicious behaviour, but then security researchers find malicious behaviour in closed source software pretty regularly via reverse engineering or binary analysis. This isn't an anti-open source thing, it's a reflection that open source often isn't much of a signal of safety, unless further work has been done and continues to be done on a regular basis.

hengheng 6y ago

Still a reputation to lose, generally speaking. I have also never seen anybody who made this argument verify their free software by looking at sources before compiling.

cpach 6y ago
Exactly. Even if I would use only 100% FOSS software, I would not have the time to read all the source code of the whole stack, from the device drivers to the kernel and up to the source code of the web browser, etc etc.

enzo1982 6y ago

> But do you understand people who dare to run executables from 'proper-company' site? It's closed source, you have no idea what you are running, isn't it? As long as it's not free software in terms of FSF there is not guarantee what so ever that it's not harmful or even worse intentionally harmful. You'll have to trust somebody at some point. Do you trust the company who designed your Ethernet chip? Do you trust the person who wrote the firmware for it? If not, go and design your own network chip. Otherwise, there's no guarantee it won't spy on you. You'll also want to write your own compiler that you'll then use to build the operating system you intend to run. You won't just go download some Linux .iso to install, would you? After all, there's no guarantee it's not been manipulated by those who offer it on their website.

lovelyviking 6y ago
>You'll have to trust somebody at some point. No, I do not have to. I can choose to, but I don't have to! That is the core of the issue.If I 'have to' then I don't. I prefer checking and facts, not delusions. >Do you trust the company who designed your Ethernet chip? No, I don't and we shouldn't. I evaluate chances and we should track network activity with diff. hardware on diff. chipsets from diff. manufacturers. >Do you trust the person who wrote the firmware for it? No, I don't and we shouldn't as it's insane to do so. >If not, go and design your own network chip. There are other means to overcome this: encryption. But yes, you right, we should make open source network chip. Agree. I certainly plan to design it. >Otherwise, there's no guarantee it won't spy on you. That is correct, I agree with you. >You'll also want to write your own compiler. Yes, that is correct. I want and I am writing it right now. There is also an option of GNU c/c++ compiler available (GCC) https://gcc.gnu.org https://gcc.gnu.org >that you'll then use to build the operating system you intend to run. This is how you build a proper GNU/Linux system worth some degree of your trust. >You won't just go download some Linux .iso to install, would you? After all, there's no guarantee it's not been manipulated by those who offer it on their website. Exactly. Or it can be modified on the way, while you download it. For the later you can check hash sums published by a site who respects user freedom and cares about own reputation. >You'll have to trust somebody at some point. Again I do not have to, but I can choose to trust with some degree to Richard Stallman and people sharing his views. https://www.youtube.com/watch?v=n9YDz-Iwgyw https://www.youtube.com/watch?v=n9YDz-Iwgyw I have some trouble trusting FSF since he was removed from the position due to false accusations for saying (!) just saying things, which he actually didn't say if you read carefully. Speak about respect of freedom of speech. https://www.youtube.com/watch?v=7UbQ1kc1vQU https://www.youtube.com/watch?v=7UbQ1kc1vQU To trust the system we should have trust worthy components with open sourced designs starting from CPU and every chip installed and ending with each software running. That is the only way!

black_puppydog 6y ago

With companies, there's an incentive structure that usually makes it pretty obvious whether they have an interest to do really shady stuff on your PC. For "proper" companies that have established customer bases and a legit revenue model, they have an incentive to not screw everyone over and lose their trust. That's just good management. Of course, management often screws this up and then we get (justifiably) outraged HN posts. For pirated software the incentive structures are also clear, and usually point towards "yeah if given the chance they'll take everything from my HDD and make a run for it." I'm all for FOSS everything, but running a company-distributed binaries is very different from pirated ones, and I agree with GP that it baffles me someone would do the latter.

lovelyviking 6y ago
>For "proper" companies that have established customer bases and a legit revenue model, they have an incentive to not screw everyone over and lose their trust. It also depends on what company means by "not screw everyone over" Right now many companies consider practices as 'OK' while I am coming from the times when most of those modern activities considered to be virus or malware. So for me it doesn't really matter whether you have malware installed by a virus or it's hidden deeply in EULA which you can't reject partially anyway.
- black_puppydog 6y ago
  Oh I'm not trying to defend these practices in the least. But at least there is some mechanism (public outrage) there to make them think about it. That these mechanisms seem to fail and we need proper regulation is a different matter. Also in a lot of cases it's not really clear which tangible monetary benefit companies get from spying on their customers. Many cases seem to be managerial paranoia (Just in case the customers pirate!) or "because we can." Pirating and re-packaging software for torrent is also a non-negligible amount of work, and with no revenue stream besides bundling the apps with malware. So it's quite a different incentive structure still.

gjs278 6y ago

and neither of those are ransomware. do you understand the difference?

lovelyviking 6y ago
>do you understand the difference? Let's take a File System for a second as example. If you wrote your personal data on some disk drive and then to read this drive you need let's say Mac/Win because it's a closed format. And Mac/Win cost money. How it differs from ransomware then? Sure you have more time to decide, usually more than 3 days and it costs a bit less, but is it much of a difference there? Probaly a choice to start using it, but is it really a choice? In many cases it's not really. So back to your point, I understand it, but do you?
- gjs278 6y ago
  so no, you don’t. the sony root kit did not ransomware your data. your new example is also 100x less harmful than encrypting your data for ransom. you’re grasping at straws.