Hacker News Reader

Comment by baz00 | Hacker News Reader

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done.

Worst is I've seen CD/CI systems which just pull unsigned unverified binaries off the internet and build software from github, random APT and YUM repos, all sorts of shit. This is then all thrown together and pushed into production systems.

View on HN

Other than reputation analysis by Snyk, I honestly don’t know how to objectively analyze one repo/package versus another.

Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive).

I actually considered first steps in making a business out of this idea, but I’m convinced that every developer overestimates their ability to identify untrustworthy repos/packages and companies aren’t willing to pay the actual cost (with either subscription dollars or in the friction it would add to reject almost all 3rd party code because it doesn’t meet high standards of quality and security in a transparent and verifiable way).

>Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive).

Related: have you tried throwing a file (or a hash) at VirusTotal lately? If it's executable, they'll run it in a sandbox and give you a forensic report of everything it touched and did.

I'm so suspicious of software I can't at least review the source code of that originates outside of trusted channels that I probably wouldn't run anything meeting that description that I couldn't compile myself if it weren't for that (and similar) tools.

Virus scan is only 1% of security.

Eg. How do I know with any certainty that a library passes all OWASP best practices? Or is well documented? Or is maintained? Or is responsive to security reports? [… and dozens of other similar properties]

Reviewing code is an insurmountable task if you're using more than a few very simple packages.

It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2]

[1] https://en.wikipedia.org/wiki/FedRAMP

[2] https://slsa.dev/

In theory, yes. Who has really reviewed and analyzed every line of Kafka or Spark? Even the bigcos.. don't.

Ah, I remember when we all did that. It was just part of basic due diligence - pull all your dependencies into your own build system, review and check compatibility, then build completely locally.

Of course a lot of what we built wasn’t public facing or exposed to the internet at all, so addressing the latest vulnerabilities in record time wasn’t quite as important as known-good builds.

I’ve worked in one or two places recently (big bank) that are large enough to have their own internal repo systems and teams of security/compliance reviewers. Their versions of things can be a bit behind but are at least under control of the same org. Everywhere else, well, it feels a bit like cowboy country…

(edit - the other trade-off was of course that you wrote a lot more of everything yourself, rather than pulling in whatever you felt like. This slows down the development cycle significantly but it does mean people had a greater understanding of everything in their stack, and products were often more lean as a result.)

I personally believe this is going to be the biggest security nightmare of the next ten years. All those npm/gem/pip/deb packages that are imported by thousands of projects and Docker images, with maintainers who are retiring. So easy for a malicious actor to just slip in some code, and who has time to audit all those dependencies for every single update?

Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo

Who is running random curl scripts without checking the code first? Is this common now?

Quite so. A quick example from k3s installation page (https://docs.k3s.io/quick-start):

``` curl -sfL https://get.k3s.io | sh - ```

It bugs me to no end that they (those that give those instructions) are normalizing this.

Nobody reads the source code of all software they are running.

Considering:

- Not everyone is proficient in bash.

- Some install scripts can easily go on for thousands of lines, especially if they are designed to work with multiple distro or architecture, or both.

- Said install script might be integrated deep down into someone else's build pipeline.

- ... that's assuming they aren't the type that would blindly download and run random exe from the web in the first place

Pretty common, I would say.

Ever install docker on a pet Linux box? That script saves a lot of time.

Unless that is the only way that was possible to save that time, this doesn't matter.

It's like 80% of non distro Linux installers

My own estimations and observations say - 80% of programmers do. It's called "great DX" nowadays

I never understand why people get more upset about the bash script running arbitrary code than the program it's actually installing.

Oftentimes the installer needs greater system access than the code you're running, particularly on Windows

IME most of the randomly-downloaded software I've used does what it says on the tin. But there is a whole screening process: where did it come from? Does the originating site look legit? What are the possible motivations for the creator?

Besides there is no signing mechanism for your random install.sh. Maybe you check the SHA256 but if an attacker alters the script why not alter the website with the hashes too?

Aren't the most interesting things to steal already in the user's home folder, so having admin rights won't really give you that much more.

You're absolutely right

https://xkcd.com/1200/

Depends on the malware. Not all of them aim to steal, some may want to turn your PC into a botnet node, or a remote proxy for illegal activities.

It’s not that the bash script is worse than the installed program. The problem is that the bash script risks installing a malicious program.

Reply on news.ycombinator.com