Hacker News Reader

Comment by amelius | Hacker News Reader

Let's not kid ourselves. A state level actor who is playing the long game can compromise any distro, package, etc. without us knowing about it.

View on HN

That kind of defeatism isn’t helpful.

The present case also just seems malware easily detected by VirusTotal: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

Sticking-your-head-in-the-sand-ism isn't helpful either.

But nobody wants to talk about true security. For example, why does a Python module that renders progress bars (for example) need my full trust about what it does to the rest of my system? Etc.

What's the term for the fallacy that this problem can be ignored because that problem is so much worse?

Sorry, patient, why are we talking about setting your broken arm when you are genetically predisposed to cancer that's going to kill you anyway?

Nobody said the problem could be ignored ...

It is the "fallacy of relative privation", for the record.

> why does a Python module that renders progress bars (for example) need my full trust about what it does to the rest of my system?

tqdm is pure Python and available as a wheel. Or is this a general complaint about sandboxing others' code at runtime?

General complaint. Has nothing to do with tqdm.

Look at all the mainstream scanners that failed to detect it!

That’s pretty normal in my experience. That’s why you check with VirusTotal instead of a single “mainstream” scanner.

In reality, if Microsoft Defender (Security or whatever the name is) can detect it (which does in this case), it means it is flagged on most target users' machine.

Of course, there are people who disable built-in security scanning and don't use another antivirus software, and that's on them.

Unfortunately Defender also flags lots of non-malware open source software, which trains users to ignore it.

Example? Personally I have not run into a single such false positive for the past 10 years. Microsoft SmartScreen sometimes shows a warning for executables that are not digitally signed, but that's not Defender, and this is nowhere like flagging as a virus.

qBittorrent which is a reputable and popular torrent client used to download linux isos, gets flagged and removed as "potentially unwanted applications" by windows defender.

Jia Tan with the XZ backdoor was caught because some performance obsessed person noticed a tiny delay... I'm sure they learned their lesson and are ensuring their next backdoor doesn't impact performance.

That is the insidious question - how many parallel efforts were/are in play when xz was going down? Surely that was not the only long term plan to compromise an "unrelated" component of system security. The Jia Tan organization might have already inserted back doors into dozens of different projects by now.

Sure, but realistically, how many of us right here have state level actors in our threat models? I sure don't, because it'd be impossible to live a normal life then.

But state level actors could target you, so you should immediately abandon any hope of privacy, disable your ad blockers, stop using Signal, install Windows 11, cease any complaints about the government, and eat the bugs.

How would you know?

Don't most of us know what's in our threat model?

Nobody spends energy worrying that the universe is an evil compiler that warps reality specifically to target us. Because 1) it's unlikely, and 2) if it were true there's no change in defensive posture that would help. It's the same for most individuals when considering being targeted by state actors. Unlikely, and not defensible, so no point hand wringing.

Also, no state-actor would ever blow an immensely costly and rare backdoor like that on us peasants here. Even, if you would threaten to kill all the puppies. That's the sort of thing they reserve for state-level shenanigans, 100% targeting servers, infrastructure and industry, not individuals.

Though, I also doubt, they would just shelve these epic exploits, since a universal Linux backdoor likely puts themself at risk too, unless you can pull off a grand conspiracy, or deliver patched packages to your own people without questions asked. Maybe a completely locked down country like North Korea could do it. I doubt many other countries got an incentive, unless in preparation of a specific attack.

"Nobody spends energy worrying that the universe is an evil compiler that warps reality specifically to target us"

I have not heard that specific scenario yet, but indeed quite similar ones from very depressed/mentally ill people. Basically that the whole universe was created to torture them specifically. (Probably there is even a medical term for that)

But yes, a sane person should rather be concerned to not fall scam to one of the various criminal groups. That is a real cyber threat for most people and companies.

So minding basic security helps, even if the NSA will likely get past that in no time.

As Stuxnet showed us, you don't need to run a nuclear program to be infected by malware developed by state level actors.

Which state actor? Not all pigs are equal.

Your comment reflects that truth.

Reply on news.ycombinator.com