4 ms·

It'd be nice if they didn't recommend winget for installation though. winget is an egregious security risk that Microsoft has just like pretended follows even m

It'd be nice if they didn't recommend winget for installation though. winget is an egregious security risk that Microsoft has just like pretended follows even minimal security practices, despite just launching four years ago with no protection from bad actors whatsoever and then never implementing any improvements since.

easton 1y ago
disclaimer: I used to commit to winget a lot and now I don’t. …but is it really less secure than brew or choco? The installers are coming from reasonably trusted sources and are scanned for malware by MS, a community contributor has to approve the manifest changes, and the manifests themselves can’t contain arbitrary code outside of the linked executable. Feels about as good as you can get without requiring the ISVs themselves to maintain repos.
- ocdtrekkie 1y ago
  The installers are coming from random people on the Internet. Most software repositories have trusted contributors and a policy of requiring a piece of software be arguably worthy of inclusion. Perhaps because Microsoft is afraid to pick winners, every piece of garbage is allowed on winget, and there's no way to restrict who can make changes to what packages. There are ISVs that would like to lock down their software so they can maintain it but a trillion dollar company couldn't spare a dollar to figure out a "business process" to do this. As far as I know, Microsoft has a single employee involved who has laughed off any security concerns with "well the automated malware scanner would find it". The "community contributors" were just... people active on GitHub when they launched it. Was anyone vetted in any way? No. The Microsoft Store has actual app reviewers, winget has... "eh, lgtm".
  - 90s_dev 1y ago
    The policy of including the author's name next to the project name, along with some indication that it really is the author and not an imposter, I think that's probably the best we're ever going to get, since at that point it just comes down to community trust.
dale_huevo 1y ago
winget is just Windows developers' version of curl | bash. Yet another example of Microsoft copying Linux features.
- ocdtrekkie 1y ago
  Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion. There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.
  - dale_huevo 1y ago
    If you think HTTPS is performing code validation I have news for you. HTTPS only guarantees the packets containing the unverified malicious code are not tampered with from the server to you. A server which could very well be compromised and alternate code put in its place. You are drawing an egregious apples-to-oranges comparison here. Please re-read what you said. You could serve digitally signed code over plain HTTP and it would be more secure than your example over HTTPS. Unfortunately there are a lot of HTTPS old wives' tales that many misinformed developers believe in.
  - tim-- 1y ago
    > in a reasonably secure fashion It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/ https://lukespademan.com/blog/the-dangers-of-curlbash/ There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into more/less is not enough to protect you.
    - ToValueFunfetti 1y ago
      The parent is talking about MITM, which is prevented with TLS and curl but not winget. They are saying curl is strictly better, not that it is impenetrable. If you trust the domain owner, you can trust curl | bash, but you can't trust winget

easton 1y ago

disclaimer: I used to commit to winget a lot and now I don’t. …but is it really less secure than brew or choco? The installers are coming from reasonably trusted sources and are scanned for malware by MS, a community contributor has to approve the manifest changes, and the manifests themselves can’t contain arbitrary code outside of the linked executable. Feels about as good as you can get without requiring the ISVs themselves to maintain repos.

ocdtrekkie 1y ago
The installers are coming from random people on the Internet. Most software repositories have trusted contributors and a policy of requiring a piece of software be arguably worthy of inclusion. Perhaps because Microsoft is afraid to pick winners, every piece of garbage is allowed on winget, and there's no way to restrict who can make changes to what packages. There are ISVs that would like to lock down their software so they can maintain it but a trillion dollar company couldn't spare a dollar to figure out a "business process" to do this. As far as I know, Microsoft has a single employee involved who has laughed off any security concerns with "well the automated malware scanner would find it". The "community contributors" were just... people active on GitHub when they launched it. Was anyone vetted in any way? No. The Microsoft Store has actual app reviewers, winget has... "eh, lgtm".
- 90s_dev 1y ago
  The policy of including the author's name next to the project name, along with some indication that it really is the author and not an imposter, I think that's probably the best we're ever going to get, since at that point it just comes down to community trust.

dale_huevo 1y ago

winget is just Windows developers' version of curl | bash. Yet another example of Microsoft copying Linux features.

ocdtrekkie 1y ago
Except curl | bash definitely executes code by the author controlling the URL you put in, and if the URL is HTTPS, in a reasonably secure fashion. There is no validation when you winget whether or not the executable is from the official source or that a third party contributor didn't tamper with how it's maintained.
- dale_huevo 1y ago
  If you think HTTPS is performing code validation I have news for you. HTTPS only guarantees the packets containing the unverified malicious code are not tampered with from the server to you. A server which could very well be compromised and alternate code put in its place. You are drawing an egregious apples-to-oranges comparison here. Please re-read what you said. You could serve digitally signed code over plain HTTP and it would be more secure than your example over HTTPS. Unfortunately there are a lot of HTTPS old wives' tales that many misinformed developers believe in.
- tim-- 1y ago
  > in a reasonably secure fashion It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/ https://lukespademan.com/blog/the-dangers-of-curlbash/ There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into more/less is not enough to protect you.
  - ToValueFunfetti 1y ago
    The parent is talking about MITM, which is prevented with TLS and curl but not winget. They are saying curl is strictly better, not that it is impenetrable. If you trust the domain owner, you can trust curl | bash, but you can't trust winget