3 ms·

I'm trying to imagine the kind of user that's both able to blindly install a random .deb downloaded from a website, while also being willing to do so. Linux gee

I'm trying to imagine the kind of user that's both able to blindly install a random .deb downloaded from a website, while also being willing to do so. Linux geeks with no sense of danger on the internet?

lcnPylGDnU4H9OF 3y ago
One can google "install .deb fedora" and get a litany of web pages which will contain words explaining how to do this. Fedora (and other distributions) is easy enough to install that one doesn't really need to be a "Linux geek" in order to be on Linux and such a person is not quite so likely to wonder whether or not they trust the code they're running. Couple that with the fact that it works out well Most Of The Time[0] and you've got a pretty likely scenario even if it affects a relatively small number of people. [0] I mean in general when downloading software as well as in the context of this particular story[1]. [1] > Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app.
zem 3y ago
not too terribly different from `sudo (curl | bash)`
lstamour 3y ago
If you have a web browser and Linux, you can often install a .deb just by opening it in Software Centre or other graphical utilities to install apps. The comparison might be someone on windows trusting a random .msi or installer .exe or someone on Mac installing a random .app package. It’s somewhat normal these days. Package managers are sometimes harder to understand and app stores often don’t have the app you want or the newest version. Sometimes the app directs you to the website to install an update - or updates itself from a compromised location.
mtillman 3y ago
This shocked me too. I kind of expect this to happen more on Arch because it gets marketed heavily to new users on Reddit but Debian seems geared more towards “olds” like me who just want a complete OS without a lot of effort. I couldn’t imagine using non-standard repos in a normal operating environment.

lcnPylGDnU4H9OF 3y ago

One can google "install .deb fedora" and get a litany of web pages which will contain words explaining how to do this. Fedora (and other distributions) is easy enough to install that one doesn't really need to be a "Linux geek" in order to be on Linux and such a person is not quite so likely to wonder whether or not they trust the code they're running. Couple that with the fact that it works out well Most Of The Time[0] and you've got a pretty likely scenario even if it affects a relatively small number of people. [0] I mean in general when downloading software as well as in the context of this particular story[1]. [1] > Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app.

zem 3y ago

not too terribly different from `sudo (curl | bash)`

lstamour 3y ago

If you have a web browser and Linux, you can often install a .deb just by opening it in Software Centre or other graphical utilities to install apps. The comparison might be someone on windows trusting a random .msi or installer .exe or someone on Mac installing a random .app package. It’s somewhat normal these days. Package managers are sometimes harder to understand and app stores often don’t have the app you want or the newest version. Sometimes the app directs you to the website to install an update - or updates itself from a compromised location.

mtillman 3y ago

This shocked me too. I kind of expect this to happen more on Arch because it gets marketed heavily to new users on Reddit but Debian seems geared more towards “olds” like me who just want a complete OS without a lot of effort. I couldn’t imagine using non-standard repos in a normal operating environment.