3 ms·

Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?

adastra22 1y ago
I don’t trust them enough to run as root.
- udev4096 1y ago
  But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
  - QuantumNomad_ 1y ago
    Only for binding to ports under 1024 really, like 80 (http) and 443 (https). Once it has bound to the ports it can drop down to running as a low-privilege user (usually named www or httpd or similar). On Linux you can allow your program to bind to those ports even without running the program itself as root. https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443 https://superuser.com/questions/710253/allow-non-root-proces...
    - dorianniemiec 1y ago
      When installed for example with the installer script, Ferron would run on a specialized user for running the web server. Ferron itself would also have "CAP_NET_BIND_SERVICE" capability set on its binary, so that it doesn't have to run as root.
  - adastra22 1y ago
    1) That isn’t true. 2) Even if it were, I’m not going to do so while evaluating an unknown program.
- deleted 1y ago
  [deleted]
earthnail 1y ago
Because untrustworthy websites can piggyback on the brand name. "Download ffmpeg here: sudo bash -c ..." And then the installation script from our malicious site installs ffmpeg just fine, plus some stuff you have no idea about. And you never know that you've just been hacked.
- QuantumNomad_ 1y ago
  If you get your install instructions from an untrustworthy website, there’s nothing preventing them from telling you to use a third-party apt repository or ppa that gives you a malicious version of the thing. There’s not really a difference between curl piped to bash, and installing packages from a third-party package repository that the distro maintainers have no involvement in with.
- dns_snek 1y ago
  Can you repeat this mental exercise for every other installation method you can think of? e.g. distributing deb/rpm files, distributing AppImages, asking users to add your custom repository and signing key? (Yes I know that the last one has built-in benefits for automatic updates but that's not going to protect you on initial installation and its benefits can be replicated in a more portable way in any other auto-update mechanism with a similar amount of effort) ((And if you have the patience to set up a custom repository, you can simplify initial installation process using a "curl|bash" script))
deleted 1y ago
[deleted]
alexnewman 1y ago
Read how Tls works. Many people Can mitm. That’s why we sign applications
- dns_snek 1y ago
  If they can MITM the installation script delivered over HTTPS, they can also MITM the website delivered over HTTPS. You can have 10 step instructions for users to add your PGP signing key and install your APT repository, but what difference does it make? None at all. A malicious website will copy your instructions and replace the signing key and the repository URL with their own.
  - alexnewman 1y ago
    No because the apps are signed and have it's own chain of trust independent of tls
- deleted 1y ago
  [deleted]
- Sohcahtoa82 1y ago
  I've read how TLS works. No, you can't MITM it unless your server or client have been altered to be deliberately insecure (ie, having a server with a self-signed certificate or a client that doesn't verify certificates). If you could, the entire internet would be broken.
  - alexnewman 1y ago
    What happens when your certificate authority goes after you

adastra22 1y ago

I don’t trust them enough to run as root.

udev4096 1y ago
But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
- QuantumNomad_ 1y ago
  Only for binding to ports under 1024 really, like 80 (http) and 443 (https). Once it has bound to the ports it can drop down to running as a low-privilege user (usually named www or httpd or similar). On Linux you can allow your program to bind to those ports even without running the program itself as root. https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443 https://superuser.com/questions/710253/allow-non-root-proces...
  - dorianniemiec 1y ago
    When installed for example with the installer script, Ferron would run on a specialized user for running the web server. Ferron itself would also have "CAP_NET_BIND_SERVICE" capability set on its binary, so that it doesn't have to run as root.
- adastra22 1y ago
  1) That isn’t true. 2) Even if it were, I’m not going to do so while evaluating an unknown program.
deleted 1y ago
[deleted]

earthnail 1y ago

Because untrustworthy websites can piggyback on the brand name. "Download ffmpeg here: sudo bash -c ..." And then the installation script from our malicious site installs ffmpeg just fine, plus some stuff you have no idea about. And you never know that you've just been hacked.

QuantumNomad_ 1y ago
If you get your install instructions from an untrustworthy website, there’s nothing preventing them from telling you to use a third-party apt repository or ppa that gives you a malicious version of the thing. There’s not really a difference between curl piped to bash, and installing packages from a third-party package repository that the distro maintainers have no involvement in with.
dns_snek 1y ago
Can you repeat this mental exercise for every other installation method you can think of? e.g. distributing deb/rpm files, distributing AppImages, asking users to add your custom repository and signing key? (Yes I know that the last one has built-in benefits for automatic updates but that's not going to protect you on initial installation and its benefits can be replicated in a more portable way in any other auto-update mechanism with a similar amount of effort) ((And if you have the patience to set up a custom repository, you can simplify initial installation process using a "curl|bash" script))

deleted 1y ago

[deleted]

alexnewman 1y ago

Read how Tls works. Many people Can mitm. That’s why we sign applications

dns_snek 1y ago
If they can MITM the installation script delivered over HTTPS, they can also MITM the website delivered over HTTPS. You can have 10 step instructions for users to add your PGP signing key and install your APT repository, but what difference does it make? None at all. A malicious website will copy your instructions and replace the signing key and the repository URL with their own.
- alexnewman 1y ago
  No because the apps are signed and have it's own chain of trust independent of tls
deleted 1y ago
[deleted]
Sohcahtoa82 1y ago
I've read how TLS works. No, you can't MITM it unless your server or client have been altered to be deliberately insecure (ie, having a server with a self-signed certificate or a client that doesn't verify certificates). If you could, the entire internet would be broken.
- alexnewman 1y ago
  What happens when your certificate authority goes after you