4 ms·

It's only a matter of time. Linux really only has a good malware track record due to lack of popularity.

by seanw444 5y ago

brightball 5y ago
It seems like the popularity on servers would increase the likelihood.
- seanw444 5y ago
  Yeah I'd think so too. I should clarify: lack of popularity as a desktop OS means less desktop/amateur viruses. I'd assume most server attacks are more targeted and curated. It's basically unnecessary to run any sort of anti-malware program on Linux, because not enough people use it for writing viruses for it to be profitable. And because the people who use it as a desktop are generally more knowledgeable and safe with their habits.
xyproto 5y ago
All official Arch Linux packages are curated, and the unofficial ones are ~40 lines of shell script, with a voting system on top. These mechanisms for filtering packages are normally not present on systems that are plagued with malware.
- akerl_ 5y ago
  The unofficial ones are ~40 lines of shell script that generally start by pulling down a VCS repo or tarball from somewhere. They check the checksum of tarballs, but if you’re pulling from the AUR you’re trusting not just the ~40 lines but also the much larger body of code that’s getting fetched.
  - sudosysgen 5y ago
    No package maintainer is verifying the code of every update of the software they're packaging. Those 40 lines of shell script are the only relevant difference between packages and the AUR, security wise.
    - akerl_ 5y ago
      In the core repos, those 40 lines still exist. The AUR and core repos use the same PKGBUILD scripts. So the shell script isn’t a difference between core and AUR packages. As for the security review, I’d agree that no maintainer is verifying the code in every update of the software they’re packaging. This doesn’t mean that, as implied in the comment I replied to, you only have to review the 40 lines. It means that you’re accepting risk or accepting workload in either case (or both!), depending on how deep you look into the supply chain.
      - sudosysgen 5y ago
        Yes, of course, the 40 lines still exist for the core repos, but the maintainers are presumably trusted. I agree with the rest, I'm really talking more about the comparative risk from AUR compared to the repos. The real danger is that someone snuck something malicious in the PKGBUILD and that no one noticed yet. Other than that, the threat is the same as using the repos, assuming you trust the maintainers, which is IMO a reasonable assumption if you're already using it as your distro.

It's only a matter of time. Linux really only has a good malware track record due to lack of popularity.

brightball 5y ago

It seems like the popularity on servers would increase the likelihood.

seanw444 5y ago
Yeah I'd think so too. I should clarify: lack of popularity as a desktop OS means less desktop/amateur viruses. I'd assume most server attacks are more targeted and curated. It's basically unnecessary to run any sort of anti-malware program on Linux, because not enough people use it for writing viruses for it to be profitable. And because the people who use it as a desktop are generally more knowledgeable and safe with their habits.

xyproto 5y ago

All official Arch Linux packages are curated, and the unofficial ones are ~40 lines of shell script, with a voting system on top. These mechanisms for filtering packages are normally not present on systems that are plagued with malware.

akerl_ 5y ago
The unofficial ones are ~40 lines of shell script that generally start by pulling down a VCS repo or tarball from somewhere. They check the checksum of tarballs, but if you’re pulling from the AUR you’re trusting not just the ~40 lines but also the much larger body of code that’s getting fetched.
- sudosysgen 5y ago
  No package maintainer is verifying the code of every update of the software they're packaging. Those 40 lines of shell script are the only relevant difference between packages and the AUR, security wise.
  - akerl_ 5y ago
    In the core repos, those 40 lines still exist. The AUR and core repos use the same PKGBUILD scripts. So the shell script isn’t a difference between core and AUR packages. As for the security review, I’d agree that no maintainer is verifying the code in every update of the software they’re packaging. This doesn’t mean that, as implied in the comment I replied to, you only have to review the 40 lines. It means that you’re accepting risk or accepting workload in either case (or both!), depending on how deep you look into the supply chain.
    - sudosysgen 5y ago
      Yes, of course, the 40 lines still exist for the core repos, but the maintainers are presumably trusted. I agree with the rest, I'm really talking more about the comparative risk from AUR compared to the repos. The real danger is that someone snuck something malicious in the PKGBUILD and that no one noticed yet. Other than that, the threat is the same as using the repos, assuming you trust the maintainers, which is IMO a reasonable assumption if you're already using it as your distro.