5 ms·

> Most of the world does not care. I suspect that is more true today than ever before. There are now adults that grew up in the age of social media that have no

by mjr00 9mo ago

> Most of the world does not care. I suspect that is more true today than ever before. There are now adults that grew up in the age of social media that have no idea how local computing works. Yep. I was amazed when I was talking to a friend who's a bit younger (late 20s) and told him about a fangame you could just download from a website (Dr Robotnik's Ring Racers, for the record) and he was skeptical and concerned at the idea of just downloading and running an executable from somewhere on the internet. I suspect most adults these days are like this; their computing experience is limited to the web browser and large official corporate-run software repositories e.g. app stores and Steam. Which ironically means they would do just fine on Linux, but there's also no incentive for them to switch off Windows/MacOS. To them, Microsoft and Apple having control of their files and automatically backing up their home directory to Azure/iCloud is a feature, not a problem.

wilsonnb3 9mo ago
To be fair, downloading and running random executables from the internet is a genuinely terrible security model when the OS (like Windows, Linux, or (to a lesser extent) MacOS) does nothing to prevent it from doing anything you can do.
Aurornis 9mo ago
> and he was skeptical and concerned at the idea of just downloading and running an executable from somewhere on the internet Ironically, being concerned and skeptical about running random executables from the internet is a good idea in general.
- mjr00 9mo ago
  > Ironically, being concerned and skeptical about running random executables from the internet is a good idea in general. I agree you shouldn't run random executables, but the key word is "random". In this case, Ring Racers is a relatively established and somewhat well-known game, plus it's open-source. It doesn't guarantee it's not harmful of course, but ultimately for someone with the mindset of "I should never run any programs that aren't preapproved by a big corporation", they may as well just stick to Windows/MacOS or mobile devices where this is built into the ecosystem.
  - Nextgrid 9mo ago
    > plus it's open-source Open-source only matters if you have the time/skill/willingness to download said source (and any dependencies') and compile it. Otherwise you're still running a random binary and there's no telling whether the source is malicious or whether the binary was even built with the published source.
    - MaxBarraclough 9mo ago
      It's no guarantee, but it's a positive indicator of trustworthiness if a codebase is open source. I don't have hard numbers on this, but in my experience it's pretty rare for an open source codebase to contain malware. Few malicious actors are bold enough to publish the source of their malware. The exception that springs to mind is source-based supply chain attacks, such as publishing malicious Python code to Python's pip package-manager. You have a valid point that a binary might not correspond to the supposed source code, but I think this is quite uncommon.
      - Nextgrid 9mo ago
        > It's no guarantee, but it's a positive indicator of trustworthiness if a codebase is open source. It's something we as techies like to believe due to solidarity or belief in the greater good, but I'm not sure it's actually justified? It would only work if there's a sizeable, technically-inclined userbase of the project so that someone is likely to have audited the code. If you're malicious, you can still release malicious software with an open-source cover (ideally without the source including the malicious part - but even then, you can coast just fine until someone comes along and actually checks said source). If you're anonymous there is little actual downside of detection, you can just try again under a different project. Remember that the xz-utils backdoor was only discovered because they fucked up and caused a slowdown and not due to an unprompted audit.
        MaxBarraclough 9mo ago
        > It would only work if there's a sizeable, technically-inclined userbase of the project so that someone is likely to have audited the code. Not really. There's a long history of seemingly credible closed-source codebases turning out to have concealed malicious functionality, such as smart TVs spying on user activity, or the 'dieselgate' scandal, or the Sony rootkit. This kind of thing is extremely rare in Free and Open Source software. The creators don't want to run the risk of someone stumbling across the plain-as-day source code of malicious functionality. Open source software also generally makes it easy to remove malicious functionality, or even to create an ongoing fork project for this purpose. (The VSCodium project does this, roughly speaking. [0]) Firefox's telemetry is one of the more high-profile examples of unwanted behaviour in Free and Open Source software, and that probably doesn't even really count as malware. > If you're malicious, you can still release malicious software with an open-source cover (ideally without the source including the malicious part - but even then, you can coast just fine until someone comes along and actually checks said source). I already acknowledged this is possible, you don't need to spell it out. Again I don't have hard numbers, but it seems to me that in practice this is quite rare compared to malicious closed-source software of the 'ordinary' kind. A good example of this was SourceForge injecting adware into binaries. [1] > Remember that the xz-utils backdoor was only discovered because they fucked up and caused a slowdown and not due to an unprompted audit. Right, that was a supply chain attack. They seem to be increasingly common, unfortunately. [0] https://vscodium.com/ https://vscodium.com/ [1] https://en.wikipedia.org/wiki/SourceForge#Installer_with_adware https://en.wikipedia.org/wiki/SourceForge#Installer_with_adw...
- dTal 9mo ago
  As a threat model, it's a little outmoded. With the browser being an application platform, you do this every time you click a link. There's something sinister about considering a local open source application as dangerous but a closed source "cloud" app as safe.
raincole 9mo ago
> he was skeptical and concerned at the idea of just downloading and running an executable from somewhere on the internet. It's quite concerning that you frame this as a bad idea.
- mjr00 9mo ago
  > It's quite concerning that you frame this as a bad idea. Downloading and executing other people's compiled software is how things worked for many decades. It's only been in recent years that people have come to believe that Google/Microsoft/Apple should be the final authorities on which executables are safe to run.
  - KronisLV 9mo ago
    > It's only been in recent years that people have come to believe that Google/Microsoft/Apple should be the final authorities on which executables are safe to run. I mean, the OS package repositories at least have some vetting and processes behind them, as opposed to a random website found online - so there's surely middle ground there! You don't need to give everything up to a few big corpos to have at least a bit of a sense of security - I personally trust the Debian maintainers quite a bit due to their track record, short of bad actors infiltrating the community or accounts getting compromised.

by mjr00 9mo ago

wilsonnb3 9mo ago

To be fair, downloading and running random executables from the internet is a genuinely terrible security model when the OS (like Windows, Linux, or (to a lesser extent) MacOS) does nothing to prevent it from doing anything you can do.

Aurornis 9mo ago

> and he was skeptical and concerned at the idea of just downloading and running an executable from somewhere on the internet Ironically, being concerned and skeptical about running random executables from the internet is a good idea in general.

mjr00 9mo ago
> Ironically, being concerned and skeptical about running random executables from the internet is a good idea in general. I agree you shouldn't run random executables, but the key word is "random". In this case, Ring Racers is a relatively established and somewhat well-known game, plus it's open-source. It doesn't guarantee it's not harmful of course, but ultimately for someone with the mindset of "I should never run any programs that aren't preapproved by a big corporation", they may as well just stick to Windows/MacOS or mobile devices where this is built into the ecosystem.
- Nextgrid 9mo ago
  > plus it's open-source Open-source only matters if you have the time/skill/willingness to download said source (and any dependencies') and compile it. Otherwise you're still running a random binary and there's no telling whether the source is malicious or whether the binary was even built with the published source.
  - MaxBarraclough 9mo ago
    It's no guarantee, but it's a positive indicator of trustworthiness if a codebase is open source. I don't have hard numbers on this, but in my experience it's pretty rare for an open source codebase to contain malware. Few malicious actors are bold enough to publish the source of their malware. The exception that springs to mind is source-based supply chain attacks, such as publishing malicious Python code to Python's pip package-manager. You have a valid point that a binary might not correspond to the supposed source code, but I think this is quite uncommon.
    - Nextgrid 9mo ago
      > It's no guarantee, but it's a positive indicator of trustworthiness if a codebase is open source. It's something we as techies like to believe due to solidarity or belief in the greater good, but I'm not sure it's actually justified? It would only work if there's a sizeable, technically-inclined userbase of the project so that someone is likely to have audited the code. If you're malicious, you can still release malicious software with an open-source cover (ideally without the source including the malicious part - but even then, you can coast just fine until someone comes along and actually checks said source). If you're anonymous there is little actual downside of detection, you can just try again under a different project. Remember that the xz-utils backdoor was only discovered because they fucked up and caused a slowdown and not due to an unprompted audit.
      - MaxBarraclough 9mo ago
        > It would only work if there's a sizeable, technically-inclined userbase of the project so that someone is likely to have audited the code. Not really. There's a long history of seemingly credible closed-source codebases turning out to have concealed malicious functionality, such as smart TVs spying on user activity, or the 'dieselgate' scandal, or the Sony rootkit. This kind of thing is extremely rare in Free and Open Source software. The creators don't want to run the risk of someone stumbling across the plain-as-day source code of malicious functionality. Open source software also generally makes it easy to remove malicious functionality, or even to create an ongoing fork project for this purpose. (The VSCodium project does this, roughly speaking. [0]) Firefox's telemetry is one of the more high-profile examples of unwanted behaviour in Free and Open Source software, and that probably doesn't even really count as malware. > If you're malicious, you can still release malicious software with an open-source cover (ideally without the source including the malicious part - but even then, you can coast just fine until someone comes along and actually checks said source). I already acknowledged this is possible, you don't need to spell it out. Again I don't have hard numbers, but it seems to me that in practice this is quite rare compared to malicious closed-source software of the 'ordinary' kind. A good example of this was SourceForge injecting adware into binaries. [1] > Remember that the xz-utils backdoor was only discovered because they fucked up and caused a slowdown and not due to an unprompted audit. Right, that was a supply chain attack. They seem to be increasingly common, unfortunately. [0] https://vscodium.com/ https://vscodium.com/ [1] https://en.wikipedia.org/wiki/SourceForge#Installer_with_adware https://en.wikipedia.org/wiki/SourceForge#Installer_with_adw...
dTal 9mo ago
As a threat model, it's a little outmoded. With the browser being an application platform, you do this every time you click a link. There's something sinister about considering a local open source application as dangerous but a closed source "cloud" app as safe.

raincole 9mo ago

> he was skeptical and concerned at the idea of just downloading and running an executable from somewhere on the internet. It's quite concerning that you frame this as a bad idea.

mjr00 9mo ago
> It's quite concerning that you frame this as a bad idea. Downloading and executing other people's compiled software is how things worked for many decades. It's only been in recent years that people have come to believe that Google/Microsoft/Apple should be the final authorities on which executables are safe to run.
- KronisLV 9mo ago
  > It's only been in recent years that people have come to believe that Google/Microsoft/Apple should be the final authorities on which executables are safe to run. I mean, the OS package repositories at least have some vetting and processes behind them, as opposed to a random website found online - so there's surely middle ground there! You don't need to give everything up to a few big corpos to have at least a bit of a sense of security - I personally trust the Debian maintainers quite a bit due to their track record, short of bad actors infiltrating the community or accounts getting compromised.