5 ms·

You probably already give Microsoft RCE on your computer (or Apple, or the maintainers of your linux distro, etc).

Zambyte 2y ago
I'm curious why you think this is true of GNU/Linux distributions. I can't think of any besides Ubuntu (Snap) that this really makes sense for.
- TillE 2y ago
  Unless you're running Gentoo or similar, you're trusting your distro maintainers to produce clean, non-malicious binaries any time you install anything from the package manager.
  - a1o 2y ago
    I don't think people read the code before running a build with portage
  - Zambyte 2y ago
    Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. It's not an inevitable truth like it is with Windows or (usually) Ubuntu (not sure about MacOS).
    - Joker_vD 2y ago
      > Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. In my experience, auditing compiled executables is hard. How do you do this?
      - mass_and_energy 2y ago
        So what's your approach? Are you Amish? Or did you compile every component of your setup (UEFI firmware and [C,G]PU microcode included) from source after auditing it? Or are you just convinced that a system that can't have a third party run arbitrary code simply can't exist? Please elaborate.
        Novosell 2y ago
        Simple. First, bootstrap a new universe...
        mass_and_energy 2y ago
        Ah you see I tried that but ran into a bug: the closer you inspect one of the universe's registers, the less accurate my reading of the value is. It seems that I can either ascertain the memory location of a declared variable OR its value, but the closer I get to one, the foggier the other gets. Has anybody else encountered this bug when manipulating the fabric of space-time in Rust? It's throwing a pretty major wrench in the gears of my newest HN-inspired project: making a Rust port of the Universe for added memory safety.
      - Zambyte 2y ago
        Knowing if you have an RCE backdoor and having an RCE backdoor are two different things.
- zxexz 2y ago
  Well, you hit the nail on the head with Ubuntu - I've been trying to cut that distro out of my life, and it keeps popping up every place I've worked at. I trust Debian dearly, but even then - there's just so much surface area! At least Debian is easy to strip down (and the docs are quite good). These days I like to be explicit about everything I have installed, and still - things seep through.

I'm curious why you think this is true of GNU/Linux distributions. I can't think of any besides Ubuntu (Snap) that this really makes sense for.

TillE 2y ago
Unless you're running Gentoo or similar, you're trusting your distro maintainers to produce clean, non-malicious binaries any time you install anything from the package manager.
- a1o 2y ago
  I don't think people read the code before running a build with portage
- Zambyte 2y ago
  Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. It's not an inevitable truth like it is with Windows or (usually) Ubuntu (not sure about MacOS).
  - Joker_vD 2y ago
    > Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. In my experience, auditing compiled executables is hard. How do you do this?
    - mass_and_energy 2y ago
      So what's your approach? Are you Amish? Or did you compile every component of your setup (UEFI firmware and [C,G]PU microcode included) from source after auditing it? Or are you just convinced that a system that can't have a third party run arbitrary code simply can't exist? Please elaborate.
      - Novosell 2y ago
        Simple. First, bootstrap a new universe...
        mass_and_energy 2y ago
        Ah you see I tried that but ran into a bug: the closer you inspect one of the universe's registers, the less accurate my reading of the value is. It seems that I can either ascertain the memory location of a declared variable OR its value, but the closer I get to one, the foggier the other gets. Has anybody else encountered this bug when manipulating the fabric of space-time in Rust? It's throwing a pretty major wrench in the gears of my newest HN-inspired project: making a Rust port of the Universe for added memory safety.
    - Zambyte 2y ago
      Knowing if you have an RCE backdoor and having an RCE backdoor are two different things.
zxexz 2y ago
Well, you hit the nail on the head with Ubuntu - I've been trying to cut that distro out of my life, and it keeps popping up every place I've worked at. I trust Debian dearly, but even then - there's just so much surface area! At least Debian is easy to strip down (and the docs are quite good). These days I like to be explicit about everything I have installed, and still - things seep through.