Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #221338

Re: Anti-malware for my personal Debian workstation?

Show all headers | View raw

On Sun, 12 Apr 2020 17:41:54 +0200
<tomas@tuxteam.de> wrote:

> On Sun, Apr 12, 2020 at 10:41:12AM -0400, Celejar wrote:
> > On Sun, 12 Apr 2020 11:37:24 +0300
> > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> > 
> > > On Du, 12 apr 20, 09:17:18, tomas@tuxteam.de wrote:
> > > > On Sun, Apr 12, 2020 at 09:52:50AM +0300, Andrei POPESCU wrote:
> 
> [...]
> 
> > Interesting discussion. I've looked quickly at the other side [1],
> > however, and there seem to be serious people and arguments in that
> > direction as well. Are they so obviously wrong? [The objection Andrei
> > notes here is specifically countered by the "curl | bash" defenders,
> > although even I can see that the counter is not as strong as the
> > objection.]
> > 
> > [1]
> > https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install
> > https://news.ycombinator.com/item?id=12766049
> 
> It boils down to whom you trust. Actually the sandstorm page is
> a bit too much marketing-ish for my taste:
> 
>   "Some of the objectors, though, go a bit further: They claim
>    that curl|bash is more open to attack that other distribution
>    mechanisms [...]
> 
>    Of course, all content served by sandstorm.io – from software
>    downloads to our blog – is served strictly over HTTPS [...]"
> 
> They are mixing up the chain of trust up to the distributor (package
> signing) with the transport secutity (HTTPS). Why?
> 
> Remember that nice npm event-stream messup [1]? That's the dark
> side of "iterate faster".
> 
> Trust is a complex beast. At its bottom it can't be completely
> rational, but usually you trust a community because you somehow
> think you understand how it works and you trust the information
> chain linking you to that community.

Exactly. So if I trust the Sandstorm community (for example - I know
nothing about them), then I'm not sure that there's any particularly
great risk in installing their product via "curl | bash", and if I
don't trust them, I shouldn't install their product via any other
mechanism either.

> Cheers
> [1] https://lwn.net/Articles/773121/
> -- tomás


Celejar

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-04-11 19:10 +0200
  Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-04-11 19:50 +0200
    Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-04-24 00:00 +0200
      Re: Anti-malware for my personal Debian workstation? David Wright <deblis@lionunicorn.co.uk> - 2020-04-24 02:50 +0200
        Re: Anti-malware for my personal Debian workstation? Kenneth Parker <sea7kenp@gmail.com> - 2020-04-24 04:00 +0200
        Re: Anti-malware for my personal Debian workstation? "Rick Thomas" <rick.thomas@pobox.com> - 2020-04-24 08:50 +0200
      Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-04-24 09:00 +0200
        Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-05-03 18:20 +0200
          Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-05-03 20:00 +0200
            Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-05-04 01:40 +0200
            systemd-homed (was Re: Anti-malware for my personal Debian workstation?) Kenneth Parker <sea7kenp@gmail.com> - 2020-05-04 02:10 +0200
              Re: systemd-homed "Thomas Schmitt" <scdbackup@gmx.net> - 2020-05-04 09:20 +0200
  Re: Anti-malware for my personal Debian workstation? Joe <joe@jretrading.com> - 2020-04-12 00:10 +0200
    Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 09:10 +0200
      Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:20 +0200
    Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:10 +0200
      Re: Anti-malware for my personal Debian workstation? Dan Purgert <dan@djph.net> - 2020-04-12 17:40 +0200
      Re: Anti-malware for my personal Debian workstation? John Hasler <jhasler@newsguy.com> - 2020-04-12 21:10 +0200
  Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 09:00 +0200
    Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:20 +0200
      Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 10:40 +0200
        Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 11:00 +0200
          Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 11:50 +0200
            Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 12:10 +0200
              Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 15:10 +0200
                Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 15:50 +0200
                Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 17:50 +0200
                Re: Anti-malware for my personal Debian workstation? Gene Heskett <gheskett@shentel.net> - 2020-04-12 17:30 +0200
                Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 17:40 +0200
        Re: Anti-malware for my personal Debian workstation? Celejar <celejar@gmail.com> - 2020-04-12 16:50 +0200
          Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 17:50 +0200
            Re: Anti-malware for my personal Debian workstation? Celejar <celejar@gmail.com> - 2020-04-12 18:30 +0200
              Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 20:50 +0200
            Re: Anti-malware for my personal Debian workstation? John Hasler <jhasler@newsguy.com> - 2020-04-12 19:40 +0200

csiph-web