7 ms·

I was actually with them until "In fact, the Kitten installer does just this." You wanna make an argument that things should work differently, fine, you wanna

I was actually with them until "In fact, the Kitten installer does just this." You wanna make an argument that things should work differently, fine, you wanna even make a custom distro with brave new behavior, fine, but a package installer should not be changing such a default system behavior that will from then-on affect unknown other services. This violates least surprise in a big way and is not excused merely because the package author thinks that crufty old behavior is stupid. Even if there's a confirmation that's just more wrong than the wrong they're complaining about. I don't think it should even offer to so much as add a firewall rule just for the single port it wants to use, let alone make a change that changes the behavior and breaks universal assumptions about all ports. To give a user that level of unthinking unknowing convenience, do that in the form of a container image. Otherwise just directions, and directions that say how to configure a firewall rule not advice to change a default behavior across the board. If the user does not already know enough to ignore the bad advice and arrange for the listening mechanism themselves, or follow it but fully educated and conscious, then they are trusting you not to do bad things and take liberties with their system.

makeva 4y ago
The installer makes unexpected change that you wouldn't know how to revert (and that you would need to) unless you read at the code. It feels like we have gone back to the Windows 95's regedit era. I resent that these kinds of installer have become the norm.
- choeger 4y ago
  That's the equivalent of "just run with sudo". People don't want to deal with different configurations, policies, etc. So to provide a "one-click" Installation, they'll just change the whole environment to whatever they think they need. Good luck installing multiple such programs.
  - Brian_K_White 4y ago
    It's like homebrew making /usr/local itself and everything in it all owned by whatever user installed homebrew for years until Apple finally just took over the directory. "most macs are really single user anyway" Really? That's the excuse? I'm supposed to feel good about software coming from this quality engineering?
zwayhowder 4y ago
How to not sell your "enterprise" software to me. Have documentation that includes curl https://something.your.tld/install.bash https://something.your.tld/install.bash |sudo bash. That's a hard no. If you think that's a good idea what other shortcuts have you taken in your software development lifecycle?
- encryptluks2 4y ago
  From experience, they've built a company on SaaS and your data will soon be everyone's data.
- tsimionescu 4y ago
  That's almost universal for non-package based installation instructions on Linux, to be fair. And it is safer than "add this trusted repo to your list of repositories", since at least it's one time, not something that will be accessed every time you run "$PACKAGE_MANAGER upgrade".
  - GauntletWizard 4y ago
    There's no guarantee that their shell script doesn't also add their repo to your list of repositories, and in fact many do - I've written scripts just like that that do. I trust an application that wants me to add it's repos to it - It's pretty clear what it's doing, I can see and verify the package installation after it's done, and I can order my package manager to download the packages before installing them, inspect the package contents, and then install them afterwards. It's been demonstrated numerous times that it's easy to determine[1] whether a shell script is being downloaded via curl or executed via curl | bash ; That provides an opportunity for attackers to serve you different data if they think you're paying attention or not. But quite simply: Setting up a package repository is a professional operation and a professional concern. It's not hard hard, but it's not so simple. What it does is speak to a level of professionalism and integration - They company has decided that they will stick to your package manager's conventions, rather than invent it themselves. That's humility. That's what I want from a company that I buy from. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
a-dub 4y ago
dns runs on port 53. the rpcbind service on 111. pop and imap, both privileged, even with ssl enabled can take usernames and passwords. making this sort of change in any installer script is a terrible idea.
deleted 4y ago
[deleted]
philsnow 4y ago
> I was actually with them until > "In fact, the Kitten installer does just this." 100% agree > Even if there's a confirmation There isn't, if your sudo is set up to cache credentials and you have sudo'ed something recently enough [0]: # Reduce unprivileged ports for this session... sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80 2>&1 1>/dev/null It could be polite to `sudo -k` before that, so people who use NOPASSWD sudo (and I guess don't care as much about security on that machine) don't have the speedbump whereas people who would otherwise have to type their password indeed end up typing their password.. but still, this is too much for an installer. Just print something to stdout, make it red if you want, and include a note in the documentation to the same effect. While I was looking, I saw this a few lines down: sudo chmod 0777 "${sysctlConfigurationFilePath}" sysctl.conf(5) on my system doesn't say anything about what mode bits files in /etc/sysctl.d need to have, but +x is not often used for configuration files. I haven't looked further, but this is a smell. [0] https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81d4a450fb8a04d41457745d4/install#L171-L172 https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81... [1] https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81d4a450fb8a04d41457745d4/install#L175-L177 https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81...
- rcxdude 4y ago
  +x isn't as concerning as world-writable. This basically allows any user to escalate to root privileges through exploiting sysctl parameters like kernel.modprobe (albeit after a reboot).
- seba_dos1 4y ago
  ...and that's coming from someone who has audacity to comment on and criticize well-established security practices because they find them inconvenient. Wow. For the record, this isn't just "a smell". This is effectively a (likely unintended) backdoor for any user to gain root privileges. Any kind of user-based separation becomes moot at that point.
sph 4y ago
Yeah, I'm not touching this with a ten-foot pole. Software that changes my system configuration for their own benefit is something I try to avoid for eternity. I wouldn't trust such a development team to make smarter choices in the future.
brodouevencode 4y ago
Exactly. The quickest way to have your software put on the shitlist at any organization of any size by it's security team is to do something exactly like this.

makeva 4y ago

The installer makes unexpected change that you wouldn't know how to revert (and that you would need to) unless you read at the code. It feels like we have gone back to the Windows 95's regedit era. I resent that these kinds of installer have become the norm.

choeger 4y ago
That's the equivalent of "just run with sudo". People don't want to deal with different configurations, policies, etc. So to provide a "one-click" Installation, they'll just change the whole environment to whatever they think they need. Good luck installing multiple such programs.
- Brian_K_White 4y ago
  It's like homebrew making /usr/local itself and everything in it all owned by whatever user installed homebrew for years until Apple finally just took over the directory. "most macs are really single user anyway" Really? That's the excuse? I'm supposed to feel good about software coming from this quality engineering?

zwayhowder 4y ago

How to not sell your "enterprise" software to me. Have documentation that includes curl https://something.your.tld/install.bash https://something.your.tld/install.bash |sudo bash. That's a hard no. If you think that's a good idea what other shortcuts have you taken in your software development lifecycle?

encryptluks2 4y ago
From experience, they've built a company on SaaS and your data will soon be everyone's data.
tsimionescu 4y ago
That's almost universal for non-package based installation instructions on Linux, to be fair. And it is safer than "add this trusted repo to your list of repositories", since at least it's one time, not something that will be accessed every time you run "$PACKAGE_MANAGER upgrade".
- GauntletWizard 4y ago
  There's no guarantee that their shell script doesn't also add their repo to your list of repositories, and in fact many do - I've written scripts just like that that do. I trust an application that wants me to add it's repos to it - It's pretty clear what it's doing, I can see and verify the package installation after it's done, and I can order my package manager to download the packages before installing them, inspect the package contents, and then install them afterwards. It's been demonstrated numerous times that it's easy to determine[1] whether a shell script is being downloaded via curl or executed via curl | bash ; That provides an opportunity for attackers to serve you different data if they think you're paying attention or not. But quite simply: Setting up a package repository is a professional operation and a professional concern. It's not hard hard, but it's not so simple. What it does is speak to a level of professionalism and integration - They company has decided that they will stick to your package manager's conventions, rather than invent it themselves. That's humility. That's what I want from a company that I buy from. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

a-dub 4y ago

dns runs on port 53. the rpcbind service on 111. pop and imap, both privileged, even with ssl enabled can take usernames and passwords. making this sort of change in any installer script is a terrible idea.

deleted 4y ago

[deleted]

philsnow 4y ago

> I was actually with them until > "In fact, the Kitten installer does just this." 100% agree > Even if there's a confirmation There isn't, if your sudo is set up to cache credentials and you have sudo'ed something recently enough [0]: # Reduce unprivileged ports for this session... sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80 2>&1 1>/dev/null It could be polite to `sudo -k` before that, so people who use NOPASSWD sudo (and I guess don't care as much about security on that machine) don't have the speedbump whereas people who would otherwise have to type their password indeed end up typing their password.. but still, this is too much for an installer. Just print something to stdout, make it red if you want, and include a note in the documentation to the same effect. While I was looking, I saw this a few lines down: sudo chmod 0777 "${sysctlConfigurationFilePath}" sysctl.conf(5) on my system doesn't say anything about what mode bits files in /etc/sysctl.d need to have, but +x is not often used for configuration files. I haven't looked further, but this is a smell. [0] https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81d4a450fb8a04d41457745d4/install#L171-L172 https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81... [1] https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81d4a450fb8a04d41457745d4/install#L175-L177 https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81...

rcxdude 4y ago
+x isn't as concerning as world-writable. This basically allows any user to escalate to root privileges through exploiting sysctl parameters like kernel.modprobe (albeit after a reboot).
seba_dos1 4y ago
...and that's coming from someone who has audacity to comment on and criticize well-established security practices because they find them inconvenient. Wow. For the record, this isn't just "a smell". This is effectively a (likely unintended) backdoor for any user to gain root privileges. Any kind of user-based separation becomes moot at that point.

sph 4y ago

Yeah, I'm not touching this with a ten-foot pole. Software that changes my system configuration for their own benefit is something I try to avoid for eternity. I wouldn't trust such a development team to make smarter choices in the future.

brodouevencode 4y ago

Exactly. The quickest way to have your software put on the shitlist at any organization of any size by it's security team is to do something exactly like this.