13 ms·

> As opposed to the Linux security best practices of curl | bash? Just because some people like to ask you to install their software that way doesn't make it "

• the_af 3y ago
  I don't disagree with what you're saying, but: > You can review whatever you're running How realistic is this for regular users? And even power users, in some cases. Let's say you download the install script. It's either hundreds of lines or it in turn downloads and runs some blob. Are you comfortable asserting your review is enough? Is this truly so different to clicking on some random Windows installer? If the same kind of Windows non-power users start running Linux and it becomes a really widespread desktop OS, would the situation be particularly different?
  • nephanth 3y ago
    Do regular users `curl|bash`? From my experience that's a pretty rare occurence: stuff users need is generally in the repos
    • the_af 3y ago
      > Do regular users `curl|bash`? They don't (unless following instructions). But that's my point: downloading stuff and "reviewing" it is not feasible except for power users -- which are not the scenario we're describing -- and not even then! Can you tell me you trust yourself to review a non-trivial install script? > stuff users need is generally in the repos Even games? If we're talking about regular users, they'll want to play games and other things not packaged with their repo.
    • amalcon 3y ago
      What's confusing here is that desktop Linux almost doesn't have "regular users". You're a power user already if you are running apt, much less curl|bash. It's not super meaningful to ask what the small number of "regular" desktop Linux users are doing; what is meaningful is to ask what they would do if they existed. Which is probably the same thing they do on Windows: use a browser to download and run whatever program claims to do what they want.
      • the_af 3y ago
        Exactly! You articulated that better than I did.
      • nephanth 3y ago
        Ubuntu has an app store (a graphical interface to apt at the time), when my grandpa was running Linux that's what we taught him to use (not often did he install anything though: libreoffice, an email client and a browser was pretty much all he needed)
  • JadeNB 3y ago
    > How realistic is this for regular users? And even power users, in some cases. Let's say you download the install script. It's either hundreds of lines or it in turn downloads and runs some blob. Are you comfortable asserting your review is enough? > Is this truly so different to clicking on some random Windows installer? Yes, because you literally can't look in a random Windows installer (or, at least, it's not made to allow you to do so). It's true that many users won't have the competence to read and understand source code, but … it seems like that may be a genuinely unsolvable problem (if you want powerful software to be available to non-dev users); I don't know much about my car, but I could, and, when it is genuine complexity making understanding difficult rather than intentional black-boxing and obfuscation, I don't blame that on the car manufacturer.
    • wongarsu 3y ago
      > Yes, because you literally can't look in a random Windows installer Most windows installers are regular archive formats, with either msi information or an executable tacked on. They open just fine in 7zip. Of course analyzing the binary files inside the installer is another matter.
      • nullindividual 3y ago
        MSIs often contain CAB files, which 7Zip can also open, though usually files in MSIs aren't named the same as their uncompressed files (i.e., .dl_ for .dll).
    • the_af 3y ago
      I think realistically you cannot expect any user, in any system, to be able to review arbitrary scripts. Experts can, but it's asking too much of regular users who aren't programmers. And therefore, that's the answer of why Linux is "safer" than Windows.
  • mcpackieh 3y ago
    Regular users on linux shouldn't be downloading software through their web-broswer at all; that's a Windowsism. Regular users on linux should be using their package manager to install new software. Say what you want about Debian's volunteers, but they're a hell of a lot more trustworthy than the average windows software download website.
    • tumult 3y ago
      Regular users on Linux shouldn’t run commercial software?
      • washadjeffmad 3y ago
        Is commercial software incapable of being packaged?
        • iscream26 3y ago
          No, but packaging a software package for every Linux distro that exists is unfeasible. Not that I care though, I don't run commercial software. But, you know, devil's advocate and all that. Still, I completely understand why someone might be frustrated by the way software is usually installed in Linux if they were, say, a game developer.
          • askiiart 3y ago
            Yes, packaging a software package for every Linux distro _is_ unfeasible, but have you ever used Linux? There are snaps, flatpaks, and AppImages, which can all run in any distro, and are generally more secure than "native" packages (for lack of a better word).
            • iscream26 3y ago
              > Snaps A technology superseded by Flatpaks, yet pushed incessantly by Canonical, a befuddling move that I still don't quite understand. Rough to use in any other distro. > AppImages Speaking from experience, these don't run on every distro. So they fail to fulfill their intended purpose. As far as I'm concerned, that makes distributing software as AppImages a no-go. > Flatpak Better than any of the technologies previously quoted, but it is not without it's own issues. The chances of a Flatpak working on any particular distro are acceptably high, but they still suffer from the same problem AppImages do. I've had an instance were a an app refused to run on OpenSUSE, even though it was working completely fine on Fedora (I was using Flathub's repo on both distros, I wasn't using Fedora's, just to clarify). I think it was Firefox, though I'm not 100% on that. Still, I'm yet to see a commercial software being distributed as a Flatpak. My guess is that it's all more of a hassle than it is worth. Which, I guess you could say that about packaging commercial software for Linux in general. So, we're back to square one with the chicken and the egg problem that Linux suffers from. Though nowadays it's less severe what with the existence of SteamOS and all of that, so at least there is a substantial marketshare, small as it is. EDIT: fixed vertical spacing.
  • blkhp19 3y ago
    regular users don't use linux lol...
    • the_af 3y ago
      That misses the point. There was a context to my reply! I know regular users don't use Linux. What I'm refuting is the notion that Linux is safer than Windows because "you can review the install script". What I'm arguing is that you really can't review anything. Suppose Linux were to magically go mainstream on the desktop: you cannot ask users to review installers. That's crazy. Finally, what I'm supporting is the assertion that Linux is safer from malware precisely because it's less widespread than Windows, making it a less interesting attack target for malware creators.
  • anonym29 3y ago
    Unpopular opinion: "regular users" are, by their very nature, incapable of using any networked operating system with a 100% certainty of not infecting themselves with malware. They're not qualified to only make safe decisions during their computing because they're not educated enough to understand what makes any given action safe or unsafe. Using a computer is fundamentally not like using a car. Using a car, by and large, does not change. The only major exceptions are when the user fails to properly maintain it, altering weather conditions, and altering traffic conditions. Once a driver has driven in any given permutation of traffic condition and weather condition, as long as they've maintained their vehicle, the driver's experience will be almost identical when they find themselves in that same permutation of conditions again. This consistency allows drivers to build experience in adjusting their driving to operate in those conditions, which makes them better at it in those same conditions in the future. We let laypeople drive, even those who haven't the slightest idea of how their braking system works mechanically, because there is an extremely limited range of outcomes from pressing the brake pedal at a given pressure in a given set of conditions provided it's maintained. The scope of inputs we give drivers is ultimately tiny. Computers are not like this. The safety habits you learned in 1995 are not going to cover every threat you encounter in 2005, the safety habits you learn in 2005 won't cover every threat in 2015, and likewise from 2015 to 2025. As long as we give users a broad range of possible inputs, they will find ways to screw themselves with their own incompetence. The reason iPhones and Mac OS computers are perceived by the layperson to be more secure isn't that they're inherently less hackable, it's because they treat the average user like the moron that the average user actually is by substantially restricting the input freedoms of that user. How many millions of iPhone users didn't get hacked because the developer denied them the freedom to sideload aribtrary unsigned IPA's With great freedom comes an increased responsibility to understand the consequences of one's own actions. Users are lazy. Many are stupid. They do not read very much of anything. They do not understand the systems they are using and they don't want to. As a technologist, I love having the freedom of an unbridled OS that lets me do whatever I want, including deleting the whole file system. That kind of freedom just isn't optimal for a typical user's security. This may sound misanthropic to you, but look no further than the scores of people who microwaved or soaked their iphones because 4chan made spoofed ads that looked like real apple ads promising software updates that made it possible to charge one's iphone by microwaving it or a software update enabling waterproofing. Users really are that stupid, and will ultimately find ways to harm themselves and their devices any way you allow them to, so long as there's a competent adversary trying to get them to do it.
  • wg0 3y ago
    It is not a remote theoretical possibility but just that no one has attempted it, the PID 1 such as systemd can be replaced with an infected version of systemd and then imagine what's not possible once you as malware yourself are systemd, the ring master. This Linux superiority complex isn't rooted in reality, not that I'll ever pick Windows as my daily driver.
    • the_af 3y ago
      Exactly. I like and been using Linux as my personal and work computer for decades. But I don't delude myself about what safety is inherent to the system and what just about popularity.
  • kbenson 3y ago
    Whether regular users actually realize this or not, they shouldn't download random binaries or scripts from random sites and run them on Linux any more than they should on Windows. Contextually, it feels different, but it's not. Not really. If you want safe, there's needs to be a chain of trust or something analogous, whether that's vetted repos, trusted companies (i.e. "able to be tracked down and sued") you're installing from, or an individual or group with a vested interest in keeping things safe (a project that has a track record). Should regular users be using a script from some site to install stuff? Probably not. It's not safe. But that's not a Linux problem as much as it's a developer ecosystem problem and people not recognizing it as unsafe when they'd be leery of doing the same thing on Windows. As an example, I give you Deno's installation instructions page[1]. Notice that equivalent to curl and bash as the first available Windows installation method? You can do that, or you could winget install it from the Windows Store, which presumably goes through some vetting process. Mac OS is in there as well with a bunch of possibly unsafe options (depends on how much you trust each package system...). This isn't an OS problem, it's a community problem. Either we have the option of people being able to do less safe things, or we all run the equivalent of iOS and can only install and run software vetted by others. Pick your poison. 1: https://deno.land/manual@v1.35.0/getting_started/installation https://deno.land/manual@v1.35.0/getting_started/installatio...
  • Brian_K_White 3y ago
    "How realistic is this for regular users?" Doesn't matter. Irrelevant question. The fact that it's possible vs not-possible is the infinitely more important distinction. "Is this truly so different..." Yes. "...would the situation be particularly different?" Yes. It only takes a few people to actually check something for everyone else to benefit from the results, and we even benefit from the mere possibility that anyone could at any time. The fact that this benefit isn't 100% (we still discover 20 year old critical flaws in widely dispersed open source code) doesn't change the fact at all.
• adamc 3y ago
  While reviewing the software you are running would definitely help, it is also utterly impractical as a security measure for more than a small fraction of the folks who use software.
  • bscphil 3y ago
    Linux security best practices are to (a) only run open source software with all code changes publicly visible on a version control website, and (b) rely on an expert maintainer to have performed at least minimal review on the software. Granted, you might sometimes need to run something else, perhaps even closed source software. But insofar as that's considered necessary, the security posture of Linux isn't significantly worse than Windows, where almost everything is installed that way.
  • tracker1 3y ago
    This is a large part of why I'm a heavy proponent of Flatpak/Flathub, Snaps and AppImage. The applications themselves may have a heavier payload, but run in relative isolation. It's an overall better option for security. Not to mention app/security updates won't affect the core os, and vice-versa. It's not a panacea, but it's the best option for most people. I get why some may not like it though... I don't quite get the visceral resistance though.
    • JPws_Prntr_Fngr 3y ago
      Same reason windows nerds have a visceral resistance to software that costs money, and mac nerds have a visceral resistance to the idea that window management should be more sophisticated than pixel-hunting through a morass of overlapping crap. Nerds over-invest in a hobby/product, get locked into the inertia, start to identify with it, and must then defend it irrationally.
      • tracker1 3y ago
        The amount of money the game studios, steam and others make would counter your first point... and compared to what, Linux, where nearly everything is free and won't generally pay for software?
• ryanisnan 3y ago
  This kind of comment reeks of idealism. Sure, you can look at every single thing you install because of the OSS nature of Linux, but you are incredibly naive if you delude yourself into thinking a) that you have the bandwidth do to this and stay meaningfully productive, and b) have the technical abilities to sufficiently evaluate what each piece of software does. This take is reductive and should not be taken seriously. edit: Editing to say, I do agree with the OP in spirit, you should try to avoid running untrusted software. But the devil here is in the details, it's simply not an easily feasible goal.
  • bawolff 3y ago
    On the other hand it seems entirely possible to use only apt-get install and be happy on linux.
    • wongarsu 3y ago
      Nowadays, you can also mostly life with just choco install on Windows. Not as well vetted as Debian packages, but a lot better than google. But that only helps power users. On linux learning these things is simply a necessity because installing things outside your package manager is even less user friendly.
      • chrisdave 3y ago
        This is the essence of most of the rhetoric I'm seeing in this thread: Linux is more secure because its users are more technical.
      • hiatus 3y ago
        I thought choco software is not vetted but managed by individuals, like the AUR in arch.
      • bawolff 3y ago
        I dont know, i think the graphical frontends to package managers on linux are much easier than downloading and installing an exe on windows
• tiffanyg 3y ago
  Yup, basically. The situation is relatively straightforward, though people with biases (&/ desire to just argue &/ trolls) complicate it over and over again: UNIX, and specifically Linux as a descendant, was evolved with very sensible and fairly solid security models (in multiple ways - including balancing simplicity [making it easier for users to specify and have that specification actually match their intention] against flexibility / rigor). Furthermore, from early days, there were heated substantial arguments about security vs. usability. When I was younger, I had a more "Theo de Raadt" POV - it should be way more secure. But, I think that the arguments people like Torvalds made about "enough trouble getting adoption AT ALL", in essence, were better arguments. Linux has been pretty good through the years. Far from perfect, but a good enough mixture in terms of balancing "getting sh1t done" against "keeping people safe". Windows is a mess. It's always been a mess (though, to be fair, it DID really improve between 2000 and 2010, but only to the point sort of REQUIRED to continue to be commercially viable). The incentives etc. are all different. The M$ model is always "make things as easy as possible to just start using" and "try to keep everyone chained to the platform, in part through the otherwise almost altruistic method of never breaking ancient software". There is no question that security - in terms of what is best for the user - is not the key principle / drive, there. You can judge that however you like, or not at all - it doesn't implicitly mean Windows is "worse", because that always depends on what is "important" ... what perspective you're looking at it from. But, I certainly find that model ugly and unfortunate, personally.
• whydoyoucare 3y ago
  The same can be said of Windows users.
• deleted 3y ago
  [deleted]
• api 3y ago
  "curl | bash" exists because there are too many Linux distributions and forks of distributions, making it basically impossible to distribute Linux software any other way without losing your mind creating hundreds of different repos.
  • kbenson 3y ago
    I don't think that correctly encapsulates what's going on. Step by step directions on how to install are done because of what you say. An script you execute from the internet is a convenience method that automates those steps. For that convenience, you are trading away some level of security. It may be a very small amount, if you're getting the script from a well respected and secure source. It may be a quite lot if it's some random blog or 4chan comment. For decades now there have been methods to deal with the problem of multiple OS targets. A self extracting shell script, so the installation script is packaged with the script, is still used by companies that need to ship in a mostly distro agnostic way. You still get a single package which can be signed or include checksums. Anything that the web script would do would be just as easily accomplished. Directions to pipe a download of a script to an interpreter to execute it exist because a subset of people don't give a shit. It's nothing to do with Linux, it's everything to do with people not caring. As evidence of this, I give you Deno's install page, where they allow you to user powershell to retrieve and automatically execute a powershell script[1]. Note how the themselves call it out as a convenience. Many things in life are convenient, but aren't really all that secure, like leaving your keys in your ignition because you live somewhat remotely and feel secure. This is just another one. People like to play the odds. 1: https://deno.land/manual@v1.35.0/getting_started/installation https://deno.land/manual@v1.35.0/getting_started/installatio...
    • api 3y ago
      Convenience matters a ton. My rule of thumb is that each step halves adoption. So the fraction of potentials who actually install will be ~0.5^steps. The only time this doesn’t hold is when there is a very strong overriding driver or a mandate pushing people to overcome friction.
• JTbane 3y ago
  > Just because some people like to ask you to install their software that way doesn't make it "Linux security best practices" and it doesn't mean you need to follow those directions. It's the de-facto option for installing cross-distro software on Linux, especially if it's not in a package manager repo.
• usrusr 3y ago
  “You can review whatever you're running“ You could also review remotely hosted OOXML and its chain of oddly side-effecting dependencies.