5 ms·

Linux folks continue with running away with package security paradigms while NPM, PyPI, cargo, et. al. (like that VSCode extension registry that was on the fron

by ajross 2y ago

Linux folks continue with running away with package security paradigms while NPM, PyPI, cargo, et. al. (like that VSCode extension registry that was on the front page last week) think they can still get away with just shipping what some rando pushes.

hedora 2y ago
Shipping what randos push works great for iOS and Android too. System perl is actually good. It's too bad the Linux vendors don't bother with system versions of newer languages.
- heinrich5991 2y ago
  System rustc is also good on Arch Linux. I think system rustc-web is also fine on Debian.
  - WD-42 2y ago
    I recently re-installed and instead of installing rustup I thought I'd give the Arch rust package a shot. Supposedly it's not the "correct" way to do it but so far it's working great, none of my projects require nightly. Updates have come in maybe a day after upstream. One less thing to think about, I like it.
- g-b-r 2y ago
  Sure, there's never malware on the stores...
- ajross 2y ago
  > Shipping what randos push works great for iOS and Android too. App store software is excruciatingly vetted, though. Apple and Google spend far, far, FAR more on validating the software they ship to customers than Fedora or Canonical, and it's not remotely close. It only looks like "randos" because the armies of auditors and datacenters of validation software are hidden behind the paywall.
  - IshKebab 2y ago
    It's really not. At least on Android they have some automated vetting but that's about it. Any human vetting is mostly for business reasons. Also Windows and Mac have existed for decades and there's zero vetting there. Yeah malware exists but its easy to avoid and easily worth the benefit of actually being able to get up-to-date software from anywhere.
    - skydhash 2y ago
      > Also Windows and Mac have existed for decades and there's zero vetting there. Isn't that only for applications? All the system software are provided and vetted by the OS developer.
      - IshKebab 2y ago
        Yeah but distro package repositories mostly consist of applications and non-system libraries.
        skydhash 2y ago
        Most users only have an handful of applications installed. They may not be the same one, but flatpak is easy to setup if you want the latest version. And you're not tied to the system package manager if you want the latest for CLI software (nix, brew, toolbox,...) The nice thing about Debian is that you can have 2 full years of routine maintenance while getting reading for the next big updates. The main issue is upstream developer having bug fixes and features update on the same patch.
    - ndiddy 2y ago
      The vetting on Windows is that basically any software that isn't signed by an EV certificate will show a scary SmartScreen warning on users' computers. Even if your users aren't deterred by the warning, you also have a significant chance of your executable getting mistakenly flagged by Windows Defender, and then you have to file a request for Microsoft to whitelist you. The vetting on Mac is that any unsigned software will show a scary warning and make your users have to dig into the security options in Settings to get the software to open. This isn't really proactive, but it means that if you ship malware, Microsoft/Apple can revoke your certificate. If you're interested in something similar to this distribution model on Linux, I would check out Flatpak. It's similar to how distribution works on Windows/Mac with the added benefit that updates are handled centrally (so you don't need to write auto-update functionality into each program) and that all programs are manually vetted both before they go up on Flathub and when they change any permissions. It also doesn't cost any money to list software, unlike the "no scary warnings" distribution options for both Windows and Mac.
anotherhue 2y ago
I have observed a sharp disconnect in the philosophies of 'improving developer experience' and 'running a tight ship'. I think the last twenty years of quasi-marketing/sales/recruiting DevRel roles have pushed a narrative of frictionless development, while on the flip side security and correctness have mostly taken a back seat (special industries aside). I think it's a result of the massive market growth, but I so welcome the pendulum swinging back a little bit. Typo squatting packages being a concern at the same time as speculative execution exploits shows mind bending immaturity.
- psadauskas 2y ago
  "Security" and "Convenience" is always a tradeoff, you can never have both.
  - bluGill 2y ago
    Ture. Then the Convenience folks don't understand why the rest of us don't want the things they think are so great. There are good middle grounds, but most package managers don't even acknowledge other concerns as valid.
  - benterix 2y ago
    This is obvious, the question here is why everybody traded security for convenience and what else has to happen for people to start taking security seriously.
    - ziddoap 2y ago
      >the question here is why everybody traded security for convenience I don't think security was traded away for convenience. Everything started with convenience, and security has been trying to gain ground ever since. >happen for people to start taking security seriously Law with enforced and non-trivial consequences are the only thing that will force people to take security seriously. And even then, most probably still wont.
    - vladms 2y ago
esafak 2y ago
The future is not evenly distributed.
- deleted 2y ago
  [deleted]
Palomides 2y ago
distros get unbelievable amounts of hate for not immediately integrating upstream changes, there's really no winning
- IshKebab 2y ago
  Rightly so. The idea that all software should be packaged for all distros, and that you shouldn't want to use the latest version of software is clearly ludicrous. It only seems vaguely reasonable because it's what's always been done. If Linux had evolved a more sensible system and someone came along and suggested "no actually I think each distro should have its own package format and they should all be responsible for packaging all software in the world, and they should use old versions too for stability" they would rightly be laughed out of the room.
  - bluGill 2y ago
    There are too many distributions / formats. However distribution package are much better than snap/flatpack/docker for most uses, the only hard part is there are so many that no program can put "and is integrated into the package manager" in their release steps. You can ship a docker container in your program release - it is often done but rarely what should be done.
    - oivey 2y ago
      For some cases maybe that makes sense, but in a very large percentage it does not. As example, what if I want to build and use/deploy a Python app that needs the latest NumPy, and the system package manager doesn’t have it. It would be hard to justify for me to figure out and build a distro specific package for this rather than just using the Python package on PyPI.
      - bluGill 2y ago
        The point is the distro should provide the numpy you need.
tsimionescu 2y ago
I think the opposite is mostly true. Linux packaging folks are carefully sculpting their toys, while everyone else is mostly using upstream packages and docker containers to work around the beautiful systems. For half the software I care about on my Debian system, I have a version installed either directly from the web (curl | bash style), from the developer's own APT repo, or most likely from a separate package manager (be it MELPA, pypi, Go cache, Maven, etc).
- justinrubek 2y ago
  That sounds like an incredibly annoying way to manage software. I don't have a single thing installed that way.
- kombine 2y ago
  I use nix package manager on 3 of the systems I'm working daily (one of them HPC cluster) and none of them run NixOS. It's possible to carefully sculpt one's tools and use latest and greatest.
- deleted 2y ago
  [deleted]

by ajross 2y ago

hedora 2y ago

Shipping what randos push works great for iOS and Android too. System perl is actually good. It's too bad the Linux vendors don't bother with system versions of newer languages.

heinrich5991 2y ago
System rustc is also good on Arch Linux. I think system rustc-web is also fine on Debian.
- WD-42 2y ago
  I recently re-installed and instead of installing rustup I thought I'd give the Arch rust package a shot. Supposedly it's not the "correct" way to do it but so far it's working great, none of my projects require nightly. Updates have come in maybe a day after upstream. One less thing to think about, I like it.
g-b-r 2y ago
Sure, there's never malware on the stores...
ajross 2y ago
> Shipping what randos push works great for iOS and Android too. App store software is excruciatingly vetted, though. Apple and Google spend far, far, FAR more on validating the software they ship to customers than Fedora or Canonical, and it's not remotely close. It only looks like "randos" because the armies of auditors and datacenters of validation software are hidden behind the paywall.
- IshKebab 2y ago
  It's really not. At least on Android they have some automated vetting but that's about it. Any human vetting is mostly for business reasons. Also Windows and Mac have existed for decades and there's zero vetting there. Yeah malware exists but its easy to avoid and easily worth the benefit of actually being able to get up-to-date software from anywhere.
  - skydhash 2y ago
    > Also Windows and Mac have existed for decades and there's zero vetting there. Isn't that only for applications? All the system software are provided and vetted by the OS developer.
    - IshKebab 2y ago
      Yeah but distro package repositories mostly consist of applications and non-system libraries.
      - skydhash 2y ago
        Most users only have an handful of applications installed. They may not be the same one, but flatpak is easy to setup if you want the latest version. And you're not tied to the system package manager if you want the latest for CLI software (nix, brew, toolbox,...) The nice thing about Debian is that you can have 2 full years of routine maintenance while getting reading for the next big updates. The main issue is upstream developer having bug fixes and features update on the same patch.
  - ndiddy 2y ago
    The vetting on Windows is that basically any software that isn't signed by an EV certificate will show a scary SmartScreen warning on users' computers. Even if your users aren't deterred by the warning, you also have a significant chance of your executable getting mistakenly flagged by Windows Defender, and then you have to file a request for Microsoft to whitelist you. The vetting on Mac is that any unsigned software will show a scary warning and make your users have to dig into the security options in Settings to get the software to open. This isn't really proactive, but it means that if you ship malware, Microsoft/Apple can revoke your certificate. If you're interested in something similar to this distribution model on Linux, I would check out Flatpak. It's similar to how distribution works on Windows/Mac with the added benefit that updates are handled centrally (so you don't need to write auto-update functionality into each program) and that all programs are manually vetted both before they go up on Flathub and when they change any permissions. It also doesn't cost any money to list software, unlike the "no scary warnings" distribution options for both Windows and Mac.

anotherhue 2y ago

I have observed a sharp disconnect in the philosophies of 'improving developer experience' and 'running a tight ship'. I think the last twenty years of quasi-marketing/sales/recruiting DevRel roles have pushed a narrative of frictionless development, while on the flip side security and correctness have mostly taken a back seat (special industries aside). I think it's a result of the massive market growth, but I so welcome the pendulum swinging back a little bit. Typo squatting packages being a concern at the same time as speculative execution exploits shows mind bending immaturity.

psadauskas 2y ago
"Security" and "Convenience" is always a tradeoff, you can never have both.
- bluGill 2y ago
  Ture. Then the Convenience folks don't understand why the rest of us don't want the things they think are so great. There are good middle grounds, but most package managers don't even acknowledge other concerns as valid.
- benterix 2y ago
  This is obvious, the question here is why everybody traded security for convenience and what else has to happen for people to start taking security seriously.
  - ziddoap 2y ago
    >the question here is why everybody traded security for convenience I don't think security was traded away for convenience. Everything started with convenience, and security has been trying to gain ground ever since. >happen for people to start taking security seriously Law with enforced and non-trivial consequences are the only thing that will force people to take security seriously. And even then, most probably still wont.
  - vladms 2y ago

esafak 2y ago

The future is not evenly distributed.

deleted 2y ago
[deleted]

Palomides 2y ago

distros get unbelievable amounts of hate for not immediately integrating upstream changes, there's really no winning

IshKebab 2y ago
Rightly so. The idea that all software should be packaged for all distros, and that you shouldn't want to use the latest version of software is clearly ludicrous. It only seems vaguely reasonable because it's what's always been done. If Linux had evolved a more sensible system and someone came along and suggested "no actually I think each distro should have its own package format and they should all be responsible for packaging all software in the world, and they should use old versions too for stability" they would rightly be laughed out of the room.
- bluGill 2y ago
  There are too many distributions / formats. However distribution package are much better than snap/flatpack/docker for most uses, the only hard part is there are so many that no program can put "and is integrated into the package manager" in their release steps. You can ship a docker container in your program release - it is often done but rarely what should be done.
  - oivey 2y ago
    For some cases maybe that makes sense, but in a very large percentage it does not. As example, what if I want to build and use/deploy a Python app that needs the latest NumPy, and the system package manager doesn’t have it. It would be hard to justify for me to figure out and build a distro specific package for this rather than just using the Python package on PyPI.
    - bluGill 2y ago
      The point is the distro should provide the numpy you need.

tsimionescu 2y ago

I think the opposite is mostly true. Linux packaging folks are carefully sculpting their toys, while everyone else is mostly using upstream packages and docker containers to work around the beautiful systems. For half the software I care about on my Debian system, I have a version installed either directly from the web (curl | bash style), from the developer's own APT repo, or most likely from a separate package manager (be it MELPA, pypi, Go cache, Maven, etc).

justinrubek 2y ago
That sounds like an incredibly annoying way to manage software. I don't have a single thing installed that way.
kombine 2y ago
I use nix package manager on 3 of the systems I'm working daily (one of them HPC cluster) and none of them run NixOS. It's possible to carefully sculpt one's tools and use latest and greatest.
deleted 2y ago
[deleted]