3 ms·

More so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party so

by zahlman 3mo ago

More so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.

nvme0n1p1 3mo ago
It's funny how these people say Linux security is bad because random people can upload arbitrary files to AUR, but won't say Windows security is bad because random people can upload arbitrary files to Microsoft GitHub.
- tosti 3mo ago
  MS-Windows gets attacked by the hardware vendors, too.
- davkan 3mo ago
  I think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update. And unfortunately that’s how arch is mainly marketed by its users. “Arch has the latest everything, if it’s not in the repos it’s on AUR” is one of the standard selling points. Of course that speaks to how people use linux insecurely not how Linux is insecure.
  - thayne 3mo ago
    Most AUR "helpers" show you the PKGBUILD and/or a diff thereof and ask you to confirm that it looks ok before continuing the install. At least by default. Maybe most users just ignore that and always answer yes without inspecting it. I don't know. But the wiki for the AUR and Readmes for many of these tools have warning banners telling you not to blindly trust AUR packages.
    - charcircuit 3mo ago
      There are subtle things like abusing how github handles forks which can make malicious PKGBUILD a matter of just changing the rev with no hint in the file itself.
      - thayne 3mo ago
        Perhaps, but it would be pretty unusual to use a commit/hash id instead of a version tag, or the main development branch.
  - LargoLasskhyfv 3mo ago
    There is much stuff which isn't in the AUR at all, or if so in versions similar to debian default, and/or orphaned. Nonetheless, the full tray is just one yay away, which also speaks git. How you use such tools is totally up to you. So far I've been unaffected by the AUR hickups, running Cachy for about 2 years now. But I've been always wary about the AUR, trying to minimize its use. Even in the phase where I used pure Arch for several years. It tends to get messy. So less AUR is less mess.
Barrin92 3mo ago
>More so than, say, Windows? Really? significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls, least privilege, UAC, mandatory integrity control and all configured out of the box. Without AppArmor or SElinux correctly configured, which it isn't on most desktop distributions in the linux world most of your apps can still read anything, there's little sandboxing. The NT Kernel was designed with an object model in mind so you always had the abilities to have rich descriptions and policies for whatever you're handling where all of that is bolted on unix systems after the fact.
- charcircuit 3mo ago
  >Windows has a coherent story when it comes to permissions and access. Yet that doesn't seem to matter much for stealer malware.
  - Barrin92 3mo ago
    it does matter, things like the Data Protection API do meaningfully reduce what you can extract from a windows system. Of course Windows regardless has taken the brunt of the attacks because it ran virtually every desktop machine in the world so people go after users anyway. Desktop Linux systems where never economically interesting for malware. But now that they have gained a modicum of traction they're going to get the exact same treatment, hence this thread. Microsoft doesn't advertise it much but they do have the advantage of controlling their build environments, software is signed etc. A system like the AUR where you pull in unsigned packages from anonymous people with so many arch users relying on it is not going to be easy to address. It lived on security through obscurity.
    - charcircuit 3mo ago
      >Data Protection API do meaningfully reduce what you can extract from a windows system It's not meaningfully reduced. The stealer just has to call CryptUnprotectData before uploading it. It's not even like it will show a suspicious prompt to the user, without having to do anything extra the stealer can silently decrypt it. I agree with the rest of the post though.
charcircuit 3mo ago
I never claimed that and in fact Windows has had a lot of malware written for it proving it too has bad security. There are more ways to attack people than third party software depos.
TiredOfLife 3mo ago
Yes. Windows has had a built in antivirus for 14 years

by zahlman 3mo ago

nvme0n1p1 3mo ago

It's funny how these people say Linux security is bad because random people can upload arbitrary files to AUR, but won't say Windows security is bad because random people can upload arbitrary files to Microsoft GitHub.

tosti 3mo ago
MS-Windows gets attacked by the hardware vendors, too.
davkan 3mo ago
I think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update. And unfortunately that’s how arch is mainly marketed by its users. “Arch has the latest everything, if it’s not in the repos it’s on AUR” is one of the standard selling points. Of course that speaks to how people use linux insecurely not how Linux is insecure.
- thayne 3mo ago
  Most AUR "helpers" show you the PKGBUILD and/or a diff thereof and ask you to confirm that it looks ok before continuing the install. At least by default. Maybe most users just ignore that and always answer yes without inspecting it. I don't know. But the wiki for the AUR and Readmes for many of these tools have warning banners telling you not to blindly trust AUR packages.
  - charcircuit 3mo ago
    There are subtle things like abusing how github handles forks which can make malicious PKGBUILD a matter of just changing the rev with no hint in the file itself.
    - thayne 3mo ago
      Perhaps, but it would be pretty unusual to use a commit/hash id instead of a version tag, or the main development branch.
- LargoLasskhyfv 3mo ago
  There is much stuff which isn't in the AUR at all, or if so in versions similar to debian default, and/or orphaned. Nonetheless, the full tray is just one yay away, which also speaks git. How you use such tools is totally up to you. So far I've been unaffected by the AUR hickups, running Cachy for about 2 years now. But I've been always wary about the AUR, trying to minimize its use. Even in the phase where I used pure Arch for several years. It tends to get messy. So less AUR is less mess.

Barrin92 3mo ago

>More so than, say, Windows? Really? significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls, least privilege, UAC, mandatory integrity control and all configured out of the box. Without AppArmor or SElinux correctly configured, which it isn't on most desktop distributions in the linux world most of your apps can still read anything, there's little sandboxing. The NT Kernel was designed with an object model in mind so you always had the abilities to have rich descriptions and policies for whatever you're handling where all of that is bolted on unix systems after the fact.

charcircuit 3mo ago
>Windows has a coherent story when it comes to permissions and access. Yet that doesn't seem to matter much for stealer malware.
- Barrin92 3mo ago
  it does matter, things like the Data Protection API do meaningfully reduce what you can extract from a windows system. Of course Windows regardless has taken the brunt of the attacks because it ran virtually every desktop machine in the world so people go after users anyway. Desktop Linux systems where never economically interesting for malware. But now that they have gained a modicum of traction they're going to get the exact same treatment, hence this thread. Microsoft doesn't advertise it much but they do have the advantage of controlling their build environments, software is signed etc. A system like the AUR where you pull in unsigned packages from anonymous people with so many arch users relying on it is not going to be easy to address. It lived on security through obscurity.
  - charcircuit 3mo ago
    >Data Protection API do meaningfully reduce what you can extract from a windows system It's not meaningfully reduced. The stealer just has to call CryptUnprotectData before uploading it. It's not even like it will show a suspicious prompt to the user, without having to do anything extra the stealer can silently decrypt it. I agree with the rest of the post though.

charcircuit 3mo ago

I never claimed that and in fact Windows has had a lot of malware written for it proving it too has bad security. There are more ways to attack people than third party software depos.

TiredOfLife 3mo ago

Yes. Windows has had a built in antivirus for 14 years