5 ms·

It's 5 lines. Took me 30 seconds. Well worth it for the performance gains. wget -O- https://updates.signal.org/desktop/apt/keys.asc https://updates.signal.org/

It's 5 lines. Took me 30 seconds. Well worth it for the performance gains. wget -O- https://updates.signal.org/desktop/apt/keys.asc https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg && cat signal-desktop-keyring.gpg | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null && echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt https://updates.signal.org/desktop/apt xenial main' |\ sudo tee -a /etc/apt/sources.list.d/signal-xenial.list && sudo apt update && sudo apt install signal-desktop

marginalia_nu 4y ago
Yeah, let's teach users to paste sudo commands into the terminal. That's great.
- rosnd 4y ago
  What alternative do you propose?
  - marginalia_nu 4y ago
    What if there was some sort of a store of snaps where you could download vetted packages with a graphical interface. A snap store, if you will.
    - cyberphobe 4y ago
      Sounds great as long as they get proper permission to distribute the software they’re distributing. Otherwise it’s just another untrusted party in the supply chain
- hsbauauvhabzb 4y ago
  Unless you audit every line of code the one liner executed, reviewing that one line doesn’t add much value.
- ChuckNorris89 4y ago
  >Yeah, let's teach users to paste sudo commands into the terminal. That's great. This is also one of my fears with pushing non tech savvy people away from Apple/Windows and onto Linux without the Snap, Flathub, or other such curated stores that ship with the distro, without which they would need to touch the terminal and run commands found on the internet. GNU/Geeks will keep shouting religiously how insecure Windows is because "grandma can download a dodgy .exe pretending to be a game and get viruses", but on Linux it's the same shit or worse, all you have to do is to convince a user new to Linux to paste and run a sudo command in the terminal as instructed by some scammy tutorial he found on Youtube when searching for "how to install Fortnite on Linux" and it's game over for him, since Youtube removed the downvote counter and the user had no idea he was running into a trap. After all, for most Average Joes, copying some text feels far less dangerous than downloading and opening a strange file. At least Windows Defender will most likely catch that malware you downloaded and warn you about it being harmful, but on Linux you have no such guardian nanny to save you. With sudo, it will do whatever self-destructive thing you tell it to do and not complain.
  - marginalia_nu 4y ago
    I've seen this extremely sketchy variant a few times curl -sfL www.marginalia.nu/install.sh | sudo sh - Even without sudo, this is extremely sketchy.
    - rosnd 4y ago
      Is it meaningfully sketchier than downloading a .deb and calling dpkg -i on it? Or cloning a git repo and building it?
      - jdiff 4y ago
        Yeah, it's possible for a web server to detect and change the returned data maliciously. Even with user agent and all other factors changed to match, it's possible to detect even the difference between being piped into another command vs being redirected to a file.
codedokode 4y ago
This is not secure at all because you just gave Signal root access to your system. By adding their keys you also have granted a permission for Signal to replace any packages on your system. I would instead manually download and unpack the app, create separate user for it, and run it in chroot. Much safer than your method.
- electromech 4y ago
  Respectfully, I don't think that's correct, or possibly I am misreading your comment. IIUC, placing a key in /usr/share/keyrings does not allow those keys to sign any package, only the packages designated with "signed-by" in the apt list. Sadly, plenty of applications still take the old "apt-key" approach of adding the keys globally (e.g., installing keys to /etc/apt/trusted.gpg.d), but I think Signal's installation process is the correct/recommended approach for distributing apt packages securely.
  - codedokode 4y ago
    Yes, I made a mistake about the key. Adding a key is safe by itself. However by adding third-party repository you are granting Signal a permission to replace packages on your system (unless you manually whitelist package names in apt preferences), and by installing a package from Signal repository you grant it root access to your system. Sadly debian-based distributions do not respect the principle of least privileges and grant unnecessary permissions to installation scripts.

marginalia_nu 4y ago

Yeah, let's teach users to paste sudo commands into the terminal. That's great.

rosnd 4y ago
What alternative do you propose?
- marginalia_nu 4y ago
  What if there was some sort of a store of snaps where you could download vetted packages with a graphical interface. A snap store, if you will.
  - cyberphobe 4y ago
    Sounds great as long as they get proper permission to distribute the software they’re distributing. Otherwise it’s just another untrusted party in the supply chain
hsbauauvhabzb 4y ago
Unless you audit every line of code the one liner executed, reviewing that one line doesn’t add much value.
ChuckNorris89 4y ago
>Yeah, let's teach users to paste sudo commands into the terminal. That's great. This is also one of my fears with pushing non tech savvy people away from Apple/Windows and onto Linux without the Snap, Flathub, or other such curated stores that ship with the distro, without which they would need to touch the terminal and run commands found on the internet. GNU/Geeks will keep shouting religiously how insecure Windows is because "grandma can download a dodgy .exe pretending to be a game and get viruses", but on Linux it's the same shit or worse, all you have to do is to convince a user new to Linux to paste and run a sudo command in the terminal as instructed by some scammy tutorial he found on Youtube when searching for "how to install Fortnite on Linux" and it's game over for him, since Youtube removed the downvote counter and the user had no idea he was running into a trap. After all, for most Average Joes, copying some text feels far less dangerous than downloading and opening a strange file. At least Windows Defender will most likely catch that malware you downloaded and warn you about it being harmful, but on Linux you have no such guardian nanny to save you. With sudo, it will do whatever self-destructive thing you tell it to do and not complain.
- marginalia_nu 4y ago
  I've seen this extremely sketchy variant a few times curl -sfL www.marginalia.nu/install.sh | sudo sh - Even without sudo, this is extremely sketchy.
  - rosnd 4y ago
    Is it meaningfully sketchier than downloading a .deb and calling dpkg -i on it? Or cloning a git repo and building it?
    - jdiff 4y ago
      Yeah, it's possible for a web server to detect and change the returned data maliciously. Even with user agent and all other factors changed to match, it's possible to detect even the difference between being piped into another command vs being redirected to a file.

codedokode 4y ago

This is not secure at all because you just gave Signal root access to your system. By adding their keys you also have granted a permission for Signal to replace any packages on your system. I would instead manually download and unpack the app, create separate user for it, and run it in chroot. Much safer than your method.

electromech 4y ago
Respectfully, I don't think that's correct, or possibly I am misreading your comment. IIUC, placing a key in /usr/share/keyrings does not allow those keys to sign any package, only the packages designated with "signed-by" in the apt list. Sadly, plenty of applications still take the old "apt-key" approach of adding the keys globally (e.g., installing keys to /etc/apt/trusted.gpg.d), but I think Signal's installation process is the correct/recommended approach for distributing apt packages securely.
- codedokode 4y ago
  Yes, I made a mistake about the key. Adding a key is safe by itself. However by adding third-party repository you are granting Signal a permission to replace packages on your system (unless you manually whitelist package names in apt preferences), and by installing a package from Signal repository you grant it root access to your system. Sadly debian-based distributions do not respect the principle of least privileges and grant unnecessary permissions to installation scripts.