Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #232366

Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems]

From tomas@tuxteam.de
Newsgroups linux.debian.user
Subject Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems]
Date 2021-03-04 19:10 +0100
Message-ID <BP0Aa-1lt-3@gated-at.bofh.it> (permalink)
References (5 earlier) <BOW3v-6Mm-3@gated-at.bofh.it> <BOW3v-6Mm-1@gated-at.bofh.it> <BOX9f-7nW-5@gated-at.bofh.it> <BOXVE-7Tw-3@gated-at.bofh.it> <BOYRH-cF-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Thu, Mar 04, 2021 at 11:16:25AM -0500, Celejar wrote:

[...]

> > - Sometime 2017 [1], Microsoft put out a version of Visual Studio
> >   which baked "phone home" functionality into its compiled "products".

[...]

> >   I call this pattern "Emergent Evil".
> 
> Outrageous, certainly - this sort of thing is one of the reasons I
> use linux and avoid Microsoft products to the extent I find practical.
> But I don't consider this a "build-chain attack."

Well, it's the compiler injecting unexpected functionality into the
compilee -- i.e. half to three quarters Thompson.

The part that I find more interesting is the "emergent evil" thing.
Somehow the techies found that it is OK to do that and they did,
in the best of their intentions. They are not the evil ones. I don't
think some manager up the ladder told them to do it. It must be the
whole corporate culture, i.e. some kind of emergent behaviour.

At the end, trust is a social thing. I trust Debian, because.

> > - NPM buildchain attacks [...]

> Agreed - this sort of thing is scary.

the one example I provided is special, because it was extremely
refined: someone taking over an orphaned npm package,
and laser-targeting one product's build chain.

> I know I can't avoid the risk
> entirely, but this is one of the reasons I try hard to limit my use of
> software to stuff in the repos. I understand it's no magic bullet
> against this type of thing, but in my (not very informed) judgment, it's
> less likely to happen to stuff that Debian is vetting. I.e., I'm hoping
> that all those hoops that Debian makes packages jump through, which
> prevent stuff I do want from entering the repos, will work here in my
> favor ;)

That's my approach, too; but I realise that trust is, at the bottom,
a social thing. Technology can only be a tool in this.

The "classical" distro way is becoming more and more difficult; for
"monsters" like Chrome, the distribution can't vet everything, and as
software becomes more and more entangled (with version dependencies
on the newest micro-version), people resort more and more to docker
images, flatpaks and what have you.

Cheers
 - t

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-02 21:10 +0100
  Re: Installation problems Brian <ad44@cityscape.co.uk> - 2021-03-02 21:40 +0100
    Re: Installation problems Weaver <weaver@riseup.net> - 2021-03-02 22:20 +0100
      Re: Installation problems <tomas@tuxteam.de> - 2021-03-02 22:30 +0100
        Re: Installation problems Brian <ad44@cityscape.co.uk> - 2021-03-03 00:10 +0100
    Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-02 22:50 +0100
      Re: Installation problems "Andrew M.A. Cater" <amacater@einval.com> - 2021-03-02 23:20 +0100
        Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 02:40 +0100
          Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 02:50 +0100
      Re: Installation problems Keith Bainbridge <ke1thozgroups@gmx.com> - 2021-03-03 00:00 +0100
        Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 10:30 +0100
          Re: Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-03 15:40 +0100
            Re: Installation problems Celejar <celejar@gmail.com> - 2021-03-03 16:40 +0100
            Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 16:40 +0100
              Re: Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-03 22:40 +0100
                Re: Installation problems Joe <joe@jretrading.com> - 2021-03-03 23:00 +0100
                Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-04 13:00 +0100
                Re: Installation problems Tixy <tixy@yxit.co.uk> - 2021-03-04 13:30 +0100
                Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-04 14:00 +0100
                Re: Installation problems Felix Miata <mrmazda@earthlink.net> - 2021-03-04 17:30 +0100
    Re: Installation problems Keith Bainbridge <ke1thozgroups@gmx.com> - 2021-03-02 23:50 +0100
      Re: Installation problems David Wright <deblis@lionunicorn.co.uk> - 2021-03-03 03:50 +0100
        Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 10:50 +0100
          Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 11:20 +0100
    Re: Installation problems Keith Bainbridge <ke1thozgroups@gmx.com> - 2021-03-03 00:00 +0100
  PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 16:30 +0100
    Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-03 22:30 +0100
      Re: PARTIAL DIAGNOSIS of Installation problems Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-03 23:00 +0100
        Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 02:50 +0100
          Re: PARTIAL DIAGNOSIS of Installation problems Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-04 03:50 +0100
            Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 04:20 +0100
              Re: PARTIAL DIAGNOSIS of Installation problems Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-04 05:10 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems <tomas@tuxteam.de> - 2021-03-04 10:00 +0100
          Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] <tomas@tuxteam.de> - 2021-03-04 09:50 +0100
            Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Joe <joe@jretrading.com> - 2021-03-04 10:50 +0100
              Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] <tomas@tuxteam.de> - 2021-03-04 14:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 15:30 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] tomas@tuxteam.de - 2021-03-04 16:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 17:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] tomas@tuxteam.de - 2021-03-04 19:10 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 19:30 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-04 23:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] <tomas@tuxteam.de> - 2021-03-04 23:40 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Joe <joe@jretrading.com> - 2021-03-04 23:50 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 15:30 +0100
              Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 14:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Joe <joe@jretrading.com> - 2021-03-04 16:10 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 17:20 +0100
                OT: Bathroom scales (was: Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems]) rhkramer@gmail.com - 2021-03-04 17:40 +0100
            Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 23:30 +0100
              [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-05 04:00 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of  Installation problems] David Christensen <dpchrist@holgerdanske.com> - 2021-03-05 06:30 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of  Installation problems] David Christensen <dpchrist@holgerdanske.com> - 2021-03-05 06:40 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-05 07:40 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of  Installation problems] <tomas@tuxteam.de> - 2021-03-05 09:20 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Gene Heskett <gheskett@shentel.net> - 2021-03-05 15:10 +0100
    Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-04 13:30 +0100
      Re: PARTIAL DIAGNOSIS of Installation problems David Wright <deblis@lionunicorn.co.uk> - 2021-03-04 18:50 +0100
      Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 23:50 +0100
        Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-05 13:20 +0100
          Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-05 21:30 +0100
            Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-05 22:20 +0100
              Re: PARTIAL DIAGNOSIS of Installation problems Joe <joe@jretrading.com> - 2021-03-05 22:50 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-05 23:30 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems Charles Curley <charlescurley@charlescurley.com> - 2021-03-06 00:40 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems Celejar <celejar@gmail.com> - 2021-03-07 01:40 +0100
    Re: PARTIAL DIAGNOSIS of Installation problems David Wright <deblis@lionunicorn.co.uk> - 2021-03-06 02:50 +0100
    Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-08 13:10 +0100
      Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} "Andrew M.A. Cater" <amacater@einval.com> - 2021-03-08 13:30 +0100
      Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} songbird <songbird@anthive.com> - 2021-03-08 17:30 +0100
        Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-08 20:20 +0100
          Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} songbird <songbird@anthive.com> - 2021-03-09 02:10 +0100
        Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-09 13:40 +0100
          Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Anssi Saari <as@sci.fi> - 2021-03-09 14:00 +0100
            Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Joe <joe@jretrading.com> - 2021-03-09 14:20 +0100
          Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-09 14:10 +0100
            Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Joe <joe@jretrading.com> - 2021-03-09 14:20 +0100
            Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-09 21:40 +0100
              Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-10 10:50 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-10 11:30 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-10 14:40 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-10 15:50 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-10 21:50 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} "Andrew M.A. Cater" <amacater@einval.com> - 2021-03-11 00:20 +0100

csiph-web