4 ms·
Cleverness and sneakiness of this technique makes people laser-focus just the Hollywood-worthy hack, and forget the larger picture that it's about trusting the
by pornel 4y ago
Cleverness and sneakiness of this technique makes people laser-focus just the Hollywood-worthy hack, and forget the larger picture that it's about trusting the host not to pwn you. If you trust the host won't screw you, it doesn't matter how many style points they could have scored on something they won't do. If you don't trust the host, don't use it, because reviewing 10 lines of bash won't save you.
• The sneakiness of this can be defeated with `tee` (or a variety of other ways like modified bash or a VM).
• dpkg runs arbitrary package scripts as root, so you still put trust in whoever signed the package.
• When you use `curl|sh` to install binary blob built from millions lines of code, it has countless other opportunities to include exploits with plausible deniability. If the host is hacked, they can put the payload in the binary, knowing you'll review the bash script like a hawk, and then YOLO the rest.
• Targeted attacks can can use your IP too.
• Your distro's overworked unpaid maintainer LGTMs packages with a glance, and won't review millions lines of code for backdoors.
• There is a huge gap between what people imagine they could have theoretically done properly to keep things secure and gather evidence of any potential wrongdoing, and what they actually do.
- ddtaylor 4y ago> dpkg runs arbitrary package scripts as root, so you still put trust in whoever signed the package. This is correct, but in those cases the maintainer is likely a much more trusted individual where more eyes are on the script as the hierarchy of maintainers sign off on things until the point it makes it into a readily accessible repository by end-users. > Your distro's overworked unpaid maintainer LGTMs packages with a glance, and won't review millions lines of code for backdoors. The same argument could be made about the Linux kernel itself, yet the system is surprisingly robust and examples of abuse are few and far between.
- Zuiii 4y ago> people [..] forget the larger picture that it's about trusting the host not to pwn you It's not about that. It's about pushing back the trust boundary to be as close to the source as possible. Of course your upstream can compromise you if they turn malicious, but having your trust boundary needlessly extend all the way out to the web server is not only unnecessary but also introduces real dangers to users (unless you also consider Transmission's incident to be one of your "Hollywood-worthy" hacks). I'm glad people are rightfully criticizing this stupid approach. I'm glad most reputable systems use off-line signatures to verify software before running it. Security is not about absolutes. It's about thresholds.