6 ms·

Which windows package managers build from source? I thought they were all binary package managers.

ramesh31 5y ago
>Which windows package managers build from source? I thought they were all binary package managers. I think the GP meant downloading random binaries through a web browser, as most people do on Windows. Package managers with hash verification are a million times safer than that.
- robonerd 5y ago
  Checking a hash is safer only if the person who commits the "known good hash" to the package repository actually verifies that goodness. If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release.
  - ramesh31 5y ago
    >If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release. Nothing short of a full code review will save you from a malicious supply chain attack. This is currently exploding with NPM as well, so building from source doesn't save you here either. See the node-ipc debacle from a few weeks ago [0], and also my own post from last week about a malware infected NPM module [1]. The reality is that yes, the days of being able to trust anything downloaded from a stranger on the internet are pretty much over now. But known-hash package management is still a good first layer of security versus downloading random binaries from the web. [0] https://nvd.nist.gov/vuln/detail/CVE-2022-23812 https://nvd.nist.gov/vuln/detail/CVE-2022-23812 [1] https://news.ycombinator.com/item?id=30963600 https://news.ycombinator.com/item?id=30963600
    - b112 5y ago
      I appreciate what you are saying, but it was over decades ago! Node is just insane, always was, along with the curl | bash crowd. Madness.
    - ryukafalz 5y ago
      > Nothing short of a full code review will save you from a malicious supply chain attack. Nonsense. Or, at least, an oversimplication. https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even... Nothing short of full code review will ensure that malicious code from a dependency doesn’t get into your program at all, but the capabilities of that malicious code once it does get into your program can certainly be limited.
      - munk-a 5y ago
        I don't disagree that Javascript in general runs with a lot more permissions than should probably be given but permissions is a very hard thing to manage. So you decide to install a node package that helps retry and automatically back off requests you want to send to your server since you're working in a mobile environment that has sketchy internet reliability... it is very hard to craft a set of permissions to allow that package to retry requests to certain addresses you'd like to retry without also letting it throw random system metrics it's collecting to an ad-server. Additionally, these permissions will be more comprehensible to review but they still need to be reviewed and reviewed by a party you trust. That's a tall order for the open source community when it comes to a volume of packages like npm or composer. You can logically look at lpad as a package and say "We're padding strings, we don't need to do anything with network traffic or disk reads" but building an automated system to make that evaluation and saving that evaluation in a tamperproof manner is going to be hard... and what happens if lpad starts trying to do a better job - operating correctly in left-to-right character sets and in languages where alignment is dictated by hyphens instead of blank space. Code isn't simple and while the above statement may seem hyperbolic I think it's just because most of us accept the risk, it's highly unlikely that malicious supply chain attacks will suddenly sink our businesses so we accept a reasonable level of security in exchange for what feels like a modest risk but actually fully 100% preventing that risk? You'll need to check every usage scenario on every set of hardware and go through that code with a fine toothed comb.
- mike_hearn 5y ago
  Hash verification does nothing as SSL is protecting ordinary downloads from MITM attacks already. Actually, binary package managers are arguably strictly less safe than getting the binaries directly from upstream because you've just introduced a (literal) "man in the middle", who might have their own agendas and their own need to monetize. Like, for example ... SourceForge did. In a different context these MITM attacks can go wrong even when they're genuinely trying to be helpful, as we may remember when Debian accidentally patched out important code from a core encryption library and caused everyone to get the same SSH keys. Generally for security you want to reduce the number of middlemen who can tamper with things, unless those middlemen are explicitly adding some sort of security value by pre-tasting the apps. So, Apple app reviewers: yes. Linux distro maintainers: sorta sometimes. Homebrew, winget etc: no. It's all automated.
  - noasaservice 5y ago
    Explain to me how SSL tells me so I know which is the right site: https://www.vlcdownload.com https://www.vlcdownloads.com https://www.videolan.com https://www.vlc.com https://www.downloadvlc.com https://www.videolan.org https://www.videolan.co.uk https://sourceforge.net/projects/vlc/ In linux/Mac, I can "sudo apt install vlc", "sudo yum install vlc", or "sudo brew install vlc". I know I'm getting a valid and good software delivery. It just works. No malware. No sketchy websites. No malware packages. On Windows, well, you feelin lucky?
    - yurymik 5y ago
      Now we have `winget install VideoLAN.VLC` :)
      - sharken 5y ago
        Which is sadly not as intuitive as 'choco install vlc', WinGet really needs to support aliases to become widely used. Chocolatey does have it's quirks though, there is both a '7zip' and a '7zip.install' package, it's not intuitive what the difference is.
    - 5y ago
- hassancf 5y ago
  Isn’t the following better than current windows package managers? a) Download file.EXE binary from somewhere b) run: certutil -hashfile file.EXE (which spits out hash value) c) search for hash value obtained at step “b” on a site like: virustotal.com : it tells you if malware is detected d) run: file.exe (if no malware detected) I honestly couldn’t find a better method on MS Windows. Other suggestions?
  - abetancort 5y ago
    Go to Github directly and find the VLC repository from there everything is straightforward. Forget Sourgeforge, it jumped the shark years ago.
tehbeard 5y ago
So do a bunch of Linux repo tools, what's your point?
- robonerd 5y ago
  My point is that I don't believe there is a "general movement away from downloading binaries" evidenced by the rise of package managers for Windows. That most linux package managers also use binary packages only strengthens my belief that there's no such trend.
  - hnlmorg 5y ago
    ramesh31 has already addressed that point though. He's right that I meant the user manually downloading binaries via searching the web for a download source vs having the package manager handle the download and install for you. Maybe I could have been more explicit, I took for granted that the context would be pretty obvious to most people. Sorry about that.
  - Brian_K_White 5y ago
    A package that isn't provided by a repo with a rep to protect isn't much different from a bare executable, but signed packages provided by repos with limited access to the root store and the signatures are quite different.
    - Brian_K_White 5y ago
      Is there something controvercial or ignorant about this statement? I've only been a sysadmin and developer since the mid 90's so for a fact I'm still in the process of getting my head out of my ass.
pmoriarty 5y ago
"Which windows package managers build from source? I thought they were all binary package managers." Gentoo's package manager mostly builds from source (though there are some binary packages available for Gentoo -- usually of huge binaries like Firefox, which take forever to build and which you have to update pretty frequently). Guix can also build from source.
- lewispollard 5y ago
  Neither of which are windows package managers, are they?
pjc50 5y ago
You really don't want to do this on Windows. People aren't going to install Visual Studio.

>Which windows package managers build from source? I thought they were all binary package managers. I think the GP meant downloading random binaries through a web browser, as most people do on Windows. Package managers with hash verification are a million times safer than that.

robonerd 5y ago
Checking a hash is safer only if the person who commits the "known good hash" to the package repository actually verifies that goodness. If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release.
- ramesh31 5y ago
  >If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release. Nothing short of a full code review will save you from a malicious supply chain attack. This is currently exploding with NPM as well, so building from source doesn't save you here either. See the node-ipc debacle from a few weeks ago [0], and also my own post from last week about a malware infected NPM module [1]. The reality is that yes, the days of being able to trust anything downloaded from a stranger on the internet are pretty much over now. But known-hash package management is still a good first layer of security versus downloading random binaries from the web. [0] https://nvd.nist.gov/vuln/detail/CVE-2022-23812 https://nvd.nist.gov/vuln/detail/CVE-2022-23812 [1] https://news.ycombinator.com/item?id=30963600 https://news.ycombinator.com/item?id=30963600
  - b112 5y ago
    I appreciate what you are saying, but it was over decades ago! Node is just insane, always was, along with the curl | bash crowd. Madness.
  - ryukafalz 5y ago
    > Nothing short of a full code review will save you from a malicious supply chain attack. Nonsense. Or, at least, an oversimplication. https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even... Nothing short of full code review will ensure that malicious code from a dependency doesn’t get into your program at all, but the capabilities of that malicious code once it does get into your program can certainly be limited.
    - munk-a 5y ago
      I don't disagree that Javascript in general runs with a lot more permissions than should probably be given but permissions is a very hard thing to manage. So you decide to install a node package that helps retry and automatically back off requests you want to send to your server since you're working in a mobile environment that has sketchy internet reliability... it is very hard to craft a set of permissions to allow that package to retry requests to certain addresses you'd like to retry without also letting it throw random system metrics it's collecting to an ad-server. Additionally, these permissions will be more comprehensible to review but they still need to be reviewed and reviewed by a party you trust. That's a tall order for the open source community when it comes to a volume of packages like npm or composer. You can logically look at lpad as a package and say "We're padding strings, we don't need to do anything with network traffic or disk reads" but building an automated system to make that evaluation and saving that evaluation in a tamperproof manner is going to be hard... and what happens if lpad starts trying to do a better job - operating correctly in left-to-right character sets and in languages where alignment is dictated by hyphens instead of blank space. Code isn't simple and while the above statement may seem hyperbolic I think it's just because most of us accept the risk, it's highly unlikely that malicious supply chain attacks will suddenly sink our businesses so we accept a reasonable level of security in exchange for what feels like a modest risk but actually fully 100% preventing that risk? You'll need to check every usage scenario on every set of hardware and go through that code with a fine toothed comb.
mike_hearn 5y ago
Hash verification does nothing as SSL is protecting ordinary downloads from MITM attacks already. Actually, binary package managers are arguably strictly less safe than getting the binaries directly from upstream because you've just introduced a (literal) "man in the middle", who might have their own agendas and their own need to monetize. Like, for example ... SourceForge did. In a different context these MITM attacks can go wrong even when they're genuinely trying to be helpful, as we may remember when Debian accidentally patched out important code from a core encryption library and caused everyone to get the same SSH keys. Generally for security you want to reduce the number of middlemen who can tamper with things, unless those middlemen are explicitly adding some sort of security value by pre-tasting the apps. So, Apple app reviewers: yes. Linux distro maintainers: sorta sometimes. Homebrew, winget etc: no. It's all automated.
- noasaservice 5y ago
  Explain to me how SSL tells me so I know which is the right site: https://www.vlcdownload.com https://www.vlcdownloads.com https://www.videolan.com https://www.vlc.com https://www.downloadvlc.com https://www.videolan.org https://www.videolan.co.uk https://sourceforge.net/projects/vlc/ In linux/Mac, I can "sudo apt install vlc", "sudo yum install vlc", or "sudo brew install vlc". I know I'm getting a valid and good software delivery. It just works. No malware. No sketchy websites. No malware packages. On Windows, well, you feelin lucky?
  - yurymik 5y ago
    Now we have `winget install VideoLAN.VLC` :)
    - sharken 5y ago
      Which is sadly not as intuitive as 'choco install vlc', WinGet really needs to support aliases to become widely used. Chocolatey does have it's quirks though, there is both a '7zip' and a '7zip.install' package, it's not intuitive what the difference is.
  - 5y ago
hassancf 5y ago
Isn’t the following better than current windows package managers? a) Download file.EXE binary from somewhere b) run: certutil -hashfile file.EXE (which spits out hash value) c) search for hash value obtained at step “b” on a site like: virustotal.com : it tells you if malware is detected d) run: file.exe (if no malware detected) I honestly couldn’t find a better method on MS Windows. Other suggestions?
- abetancort 5y ago
  Go to Github directly and find the VLC repository from there everything is straightforward. Forget Sourgeforge, it jumped the shark years ago.

tehbeard 5y ago

So do a bunch of Linux repo tools, what's your point?

robonerd 5y ago
My point is that I don't believe there is a "general movement away from downloading binaries" evidenced by the rise of package managers for Windows. That most linux package managers also use binary packages only strengthens my belief that there's no such trend.
- hnlmorg 5y ago
  ramesh31 has already addressed that point though. He's right that I meant the user manually downloading binaries via searching the web for a download source vs having the package manager handle the download and install for you. Maybe I could have been more explicit, I took for granted that the context would be pretty obvious to most people. Sorry about that.
- Brian_K_White 5y ago
  A package that isn't provided by a repo with a rep to protect isn't much different from a bare executable, but signed packages provided by repos with limited access to the root store and the signatures are quite different.
  - Brian_K_White 5y ago
    Is there something controvercial or ignorant about this statement? I've only been a sysadmin and developer since the mid 90's so for a fact I'm still in the process of getting my head out of my ass.

pmoriarty 5y ago

"Which windows package managers build from source? I thought they were all binary package managers." Gentoo's package manager mostly builds from source (though there are some binary packages available for Gentoo -- usually of huge binaries like Firefox, which take forever to build and which you have to update pretty frequently). Guix can also build from source.

lewispollard 5y ago
Neither of which are windows package managers, are they?

pjc50 5y ago

You really don't want to do this on Windows. People aren't going to install Visual Studio.