4 ms·

How is Debian / Ubuntu secure? It's signed by a maintainer. And maintainers are vetted. You trust Debian/Ubuntu to only allow trustworthy people to sign packag

How is Debian / Ubuntu secure? It's signed by a maintainer. And maintainers are vetted. You trust Debian/Ubuntu to only allow trustworthy people to sign packages. How are Docker / Python / Rust secure? I don't know any of the people who created my docker images, PyPi packages, or Rust crates. Yes. We're basically back to sending around EXE and DLL files in a ZIP. It's just that now we call it a container and proudly start it as root. BTW, I agree with the author of the article: Sometimes you're best off just merging dependency source code. It used to be called "vendoring" and was a big thing in Rails / Ruby. The big advantage is that you're not affected by future malicious package takeovers. But you can still merge security patches from upstream, if you choose to do that.

tonyhart7 2y ago
You use in house solution??? any of these guys that want build something minimal dependency free is valid concern, I agree with that but but what if people just don't want that??? it given people jobs and things to do (lol, this is serious) also there are certain things better to use third party library than develop in house like crypto
akerl_ 2y ago
The vetting process for open source maintainers has very little overlap with the vetting process for “is this person trustworthy”. This is true for individual libraries and also for Linux distros.
liontwist 2y ago
> How is Debian / Ubuntu secure? You’re also forgetting process isolation and roles which provide strong invariants to control what a given package can do. No such guarantees exist for code you load into your process.
woodruffw 2y ago
I don’t follow this reasoning: you might trust this distribution packager to be honest, but this doesn’t stop them from honestly packaging malicious code. It’s unlikely that the typical distribution packager is reviewing more than a minority of the code in the packages they’re accepting, especially between updates. There are significant advantages to the distribution model, including exact provenance at the point of delivery. But I think it’s an error to treat it as uniquely trustworthy: it’s the same code either way.
- WhyNotHugo 2y ago
  "Trust" as two meanings in English: - You can trust someone as in "think they're honest and won't betray me". - You can trust someone as in "think they are competent and won't screw-up". In this case, we trust distributions packagers in both ways. Not only do we trust that they are non-malicious, we also trust that they won't clumsily package code without even skimming through it.
  - woodruffw 2y ago
    The point was not about competency. I think typical distribution packagers are very competent. "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. We would all do well to remember that the xz backdoor was not caught by distribution code review: it was caught due to a performance side effect that the next adversary will be more careful to avoid. Software stacks are getting bigger, largely due to engineering pressures that are outside of the control of distributions. It's a basic fact that that means work for the same (or fewer) people, which in turn means less time spent on more complicated packages. Under those conditions, competency is not the deciding factor. This is, separately, why having lots of little packages can be (but isn't necessarily) a good thing: small packages that decompose into well-understood units of work can be reviewed more quickly and comprehensively, and can be assigned capabilities that can be tracked and audited with static analysis. You can't do that as easily (or at all) when every package decides to hand-roll its own subcomponents.
    - PaulDavisThe1st 2y ago
      > "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. Sure. So pick a system that includes at least one extra possible barrier to them screwing up than the system that has none.
      - woodruffw 2y ago
        It’s not “either or.” It’s been decades since a “package the world” approach has been practical at human scales. (I think it’s great that distributions provide one extra set of eyes. But we’re deluding ourselves if we think that can scale to the actual realized demand for both new software and continuous change to software. It’s also not very fair to the distributions.)
KronisLV 2y ago
> How are Docker / Python / Rust secure? I don't know any of the people who created my docker images, PyPi packages, or Rust crates. I know who created the Docker images, because I'm the person who built them! A lot of the time you can build your images either from scratch, or based on the official base images like Alpine or Ubuntu/Debian or some of the RPM base images, not that much different than downloading an ISO for a VM. With a base, you can use apk/apt/dnf to get whatever packages you want if you trust that more, just remember to clean up the package cache so it's not persisted in the layers (arguably wastes space). For most software, it actually isn't as difficult as it might have initially seemed. As an alternative, you can also look for vaguely trustworthy parties that have a variety of prepackaged images available and you can either borrow their Dockerfiles or just trust their images, for example, https://bitnami.com/stacks/containers https://bitnami.com/stacks/containers and https://hub.docker.com/u/bitnami https://hub.docker.com/u/bitnami Most likely you have to have trust somewhere in the mix, for example, I'm probably installing the Debian/Ubuntu packaged JDK instead of compiling mine in most cases, just because that's more convenient. Also, rootless containers are pretty cool! People do like Podman and other solutions a lot, you can even do some remapping with Docker if there are issues with how the containers expect to be run https://docs.docker.com/engine/security/userns-remap/ https://docs.docker.com/engine/security/userns-remap/ or if you have to use Docker and need something a bit more serious you can try this https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/
rad_gruchalski 2y ago
> It's signed by a maintainer. And maintainers are vetted. You trust Debian/Ubuntu to only allow trustworthy people to sign packages. > How are Docker / Python / Rust secure? I don't know any of the people who created my docker images, PyPi packages, or Rust crates. Me neither. But the same goes for those from Debian/Ubuntu. In fact, neither I know anyone who vets those who sign and publish packages. What I know is that I can build my own images from container files and then I’m back to installing those apparently trusted packages from Debian/Ubuntu. > We're basically back to sending around EXE and DLL files in a ZIP. It's just that now we call it a container and proudly start it as root. I don’t get your point. And what’s an rpm or deb? You also potentially run stuff as root… sudo apt install -y… post install scripts…

tonyhart7 2y ago

You use in house solution??? any of these guys that want build something minimal dependency free is valid concern, I agree with that but but what if people just don't want that??? it given people jobs and things to do (lol, this is serious) also there are certain things better to use third party library than develop in house like crypto

akerl_ 2y ago

The vetting process for open source maintainers has very little overlap with the vetting process for “is this person trustworthy”. This is true for individual libraries and also for Linux distros.

liontwist 2y ago

> How is Debian / Ubuntu secure? You’re also forgetting process isolation and roles which provide strong invariants to control what a given package can do. No such guarantees exist for code you load into your process.

woodruffw 2y ago

I don’t follow this reasoning: you might trust this distribution packager to be honest, but this doesn’t stop them from honestly packaging malicious code. It’s unlikely that the typical distribution packager is reviewing more than a minority of the code in the packages they’re accepting, especially between updates. There are significant advantages to the distribution model, including exact provenance at the point of delivery. But I think it’s an error to treat it as uniquely trustworthy: it’s the same code either way.

WhyNotHugo 2y ago
"Trust" as two meanings in English: - You can trust someone as in "think they're honest and won't betray me". - You can trust someone as in "think they are competent and won't screw-up". In this case, we trust distributions packagers in both ways. Not only do we trust that they are non-malicious, we also trust that they won't clumsily package code without even skimming through it.
- woodruffw 2y ago
  The point was not about competency. I think typical distribution packagers are very competent. "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. We would all do well to remember that the xz backdoor was not caught by distribution code review: it was caught due to a performance side effect that the next adversary will be more careful to avoid. Software stacks are getting bigger, largely due to engineering pressures that are outside of the control of distributions. It's a basic fact that that means work for the same (or fewer) people, which in turn means less time spent on more complicated packages. Under those conditions, competency is not the deciding factor. This is, separately, why having lots of little packages can be (but isn't necessarily) a good thing: small packages that decompose into well-understood units of work can be reviewed more quickly and comprehensively, and can be assigned capabilities that can be tracked and audited with static analysis. You can't do that as easily (or at all) when every package decides to hand-roll its own subcomponents.
  - PaulDavisThe1st 2y ago
    > "They won't screw up" is the wrong way to look at security: humans always screw up. We're essentially fallible. Sure. So pick a system that includes at least one extra possible barrier to them screwing up than the system that has none.
    - woodruffw 2y ago
      It’s not “either or.” It’s been decades since a “package the world” approach has been practical at human scales. (I think it’s great that distributions provide one extra set of eyes. But we’re deluding ourselves if we think that can scale to the actual realized demand for both new software and continuous change to software. It’s also not very fair to the distributions.)

KronisLV 2y ago

> How are Docker / Python / Rust secure? I don't know any of the people who created my docker images, PyPi packages, or Rust crates. I know who created the Docker images, because I'm the person who built them! A lot of the time you can build your images either from scratch, or based on the official base images like Alpine or Ubuntu/Debian or some of the RPM base images, not that much different than downloading an ISO for a VM. With a base, you can use apk/apt/dnf to get whatever packages you want if you trust that more, just remember to clean up the package cache so it's not persisted in the layers (arguably wastes space). For most software, it actually isn't as difficult as it might have initially seemed. As an alternative, you can also look for vaguely trustworthy parties that have a variety of prepackaged images available and you can either borrow their Dockerfiles or just trust their images, for example, https://bitnami.com/stacks/containers https://bitnami.com/stacks/containers and https://hub.docker.com/u/bitnami https://hub.docker.com/u/bitnami Most likely you have to have trust somewhere in the mix, for example, I'm probably installing the Debian/Ubuntu packaged JDK instead of compiling mine in most cases, just because that's more convenient. Also, rootless containers are pretty cool! People do like Podman and other solutions a lot, you can even do some remapping with Docker if there are issues with how the containers expect to be run https://docs.docker.com/engine/security/userns-remap/ https://docs.docker.com/engine/security/userns-remap/ or if you have to use Docker and need something a bit more serious you can try this https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/

rad_gruchalski 2y ago

> It's signed by a maintainer. And maintainers are vetted. You trust Debian/Ubuntu to only allow trustworthy people to sign packages. > How are Docker / Python / Rust secure? I don't know any of the people who created my docker images, PyPi packages, or Rust crates. Me neither. But the same goes for those from Debian/Ubuntu. In fact, neither I know anyone who vets those who sign and publish packages. What I know is that I can build my own images from container files and then I’m back to installing those apparently trusted packages from Debian/Ubuntu. > We're basically back to sending around EXE and DLL files in a ZIP. It's just that now we call it a container and proudly start it as root. I don’t get your point. And what’s an rpm or deb? You also potentially run stuff as root… sudo apt install -y… post install scripts…