4 ms·

Reminds me of the driver update utilities for Windows which notionally did update all your drivers, but also updates all of your viruses.

lostmsu 3y ago
As opposed to running bash scripts from the Internet.
- ndsipa_pomu 3y ago
  Well that behaviour is generally discouraged and whenever I do so, I give some due consideration to how much I trust the website. I can also eyeball what the script is doing which is more practical than disassembling some binary although it's common for the script to download a binary. Also, a lot of "install" scripts will set your system up with the software repository, so you use the standard system updates to also keep that software updated.
  - lostmsu 3y ago
    Great! I don't install driver autoupdaters from random sites either, so either subject is not an issue or your counterargument is invalid.
    - ndsipa_pomu 3y ago
      It's extremely common for Windows users to download and install malware, but very rare for Linux users to do the same, so I don't really understand your point.
- calamari4065 3y ago
  You can read those scripts, you know. If you have a passing understanding of bash, it's pretty easy to understand what a script is doing and ensure it's not malicious. Can you do that with a compiled executable?
  - lostmsu 3y ago
    You are comparing behavior of people who can read scripts with the behavior of people who consider random 3rd party driver updaters a good idea. What user can do doesn't matter. It matters what they actually do.
    - ndsipa_pomu 3y ago
      > It matters what they actually do Yes, and Windows users often install stuff from 3rd party websites whilst it's comparatively rare for Linux users.
      - lostmsu 3y ago
        > comparatively rare This would need some substantiation. I personally had not seen many setups that did not require 3rd party websites.
        ndsipa_pomu 3y ago
        Sorry, I have no numbers for that. However, typical Linux distributions include an incredible amount of software in their repositories, so it's usually only proprietary software that requires installation outside of the OS tools.
    - calamari4065 3y ago
      No, you are making that assertion. I brought up the driver thing as a joke, but you're the one that turned it into this inane whataboutism Almost all windows applications are distributed as compiled binaries. Even very advanced users would find it difficult to audit most apps. Bash scripts are in plain text, and idiomatic enough that it can be read by anyone with a passing familiarity with bash. Which is the very large majority of Linux users. The script very clearly states what it does, and if it doesn't, you shouldn't run it. Driver updaters are nearly universally malware, and the common advice has always been to avoid them as such. Similarly, running random bash scripts from the internet without even looking is discouraged in the same way. Mystery binaries are much more dangerous than a script because you can't audit them, but the same advice is given for both: don't. If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin. Windows users install malware at rates order of magnitude higher than any other system. Linux may as well have zero vulnerabilities compared to the shit that Windows users will blindly install. You're right, it's stupid to compare these situations. So why are you doing it?

lostmsu 3y ago

As opposed to running bash scripts from the Internet.

ndsipa_pomu 3y ago
Well that behaviour is generally discouraged and whenever I do so, I give some due consideration to how much I trust the website. I can also eyeball what the script is doing which is more practical than disassembling some binary although it's common for the script to download a binary. Also, a lot of "install" scripts will set your system up with the software repository, so you use the standard system updates to also keep that software updated.
- lostmsu 3y ago
  Great! I don't install driver autoupdaters from random sites either, so either subject is not an issue or your counterargument is invalid.
  - ndsipa_pomu 3y ago
    It's extremely common for Windows users to download and install malware, but very rare for Linux users to do the same, so I don't really understand your point.
calamari4065 3y ago
You can read those scripts, you know. If you have a passing understanding of bash, it's pretty easy to understand what a script is doing and ensure it's not malicious. Can you do that with a compiled executable?
- lostmsu 3y ago
  You are comparing behavior of people who can read scripts with the behavior of people who consider random 3rd party driver updaters a good idea. What user can do doesn't matter. It matters what they actually do.
  - ndsipa_pomu 3y ago
    > It matters what they actually do Yes, and Windows users often install stuff from 3rd party websites whilst it's comparatively rare for Linux users.
    - lostmsu 3y ago
      > comparatively rare This would need some substantiation. I personally had not seen many setups that did not require 3rd party websites.
      - ndsipa_pomu 3y ago
        Sorry, I have no numbers for that. However, typical Linux distributions include an incredible amount of software in their repositories, so it's usually only proprietary software that requires installation outside of the OS tools.
  - calamari4065 3y ago
    No, you are making that assertion. I brought up the driver thing as a joke, but you're the one that turned it into this inane whataboutism Almost all windows applications are distributed as compiled binaries. Even very advanced users would find it difficult to audit most apps. Bash scripts are in plain text, and idiomatic enough that it can be read by anyone with a passing familiarity with bash. Which is the very large majority of Linux users. The script very clearly states what it does, and if it doesn't, you shouldn't run it. Driver updaters are nearly universally malware, and the common advice has always been to avoid them as such. Similarly, running random bash scripts from the internet without even looking is discouraged in the same way. Mystery binaries are much more dangerous than a script because you can't audit them, but the same advice is given for both: don't. If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin. Windows users install malware at rates order of magnitude higher than any other system. Linux may as well have zero vulnerabilities compared to the shit that Windows users will blindly install. You're right, it's stupid to compare these situations. So why are you doing it?