Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #221222 > unrolled thread

Re: Anti-malware for my personal Debian workstation?

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-04-11 19:10 +0200
    Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-04-11 19:50 +0200
      Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-04-24 00:00 +0200
        Re: Anti-malware for my personal Debian workstation? David Wright <deblis@lionunicorn.co.uk> - 2020-04-24 02:50 +0200
          Re: Anti-malware for my personal Debian workstation? Kenneth Parker <sea7kenp@gmail.com> - 2020-04-24 04:00 +0200
          Re: Anti-malware for my personal Debian workstation? "Rick Thomas" <rick.thomas@pobox.com> - 2020-04-24 08:50 +0200
        Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-04-24 09:00 +0200
          Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-05-03 18:20 +0200
            Re: Anti-malware for my personal Debian workstation? "Thomas Schmitt" <scdbackup@gmx.net> - 2020-05-03 20:00 +0200
              Re: Anti-malware for my personal Debian workstation? l0f4r0@tuta.io - 2020-05-04 01:40 +0200
              systemd-homed (was Re: Anti-malware for my personal Debian workstation?) Kenneth Parker <sea7kenp@gmail.com> - 2020-05-04 02:10 +0200
                Re: systemd-homed "Thomas Schmitt" <scdbackup@gmx.net> - 2020-05-04 09:20 +0200
    Re: Anti-malware for my personal Debian workstation? Joe <joe@jretrading.com> - 2020-04-12 00:10 +0200
      Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 09:10 +0200
        Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:20 +0200
      Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:10 +0200
        Re: Anti-malware for my personal Debian workstation? Dan Purgert <dan@djph.net> - 2020-04-12 17:40 +0200
        Re: Anti-malware for my personal Debian workstation? John Hasler <jhasler@newsguy.com> - 2020-04-12 21:10 +0200
    Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 09:00 +0200
      Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 09:20 +0200
        Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 10:40 +0200
          Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 11:00 +0200
            Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 11:50 +0200
              Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 12:10 +0200
                Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 15:10 +0200
                  Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 15:50 +0200
                    Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 17:50 +0200
                  Re: Anti-malware for my personal Debian workstation? Gene Heskett <gheskett@shentel.net> - 2020-04-12 17:30 +0200
                    Re: Anti-malware for my personal Debian workstation? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 17:40 +0200
          Re: Anti-malware for my personal Debian workstation? Celejar <celejar@gmail.com> - 2020-04-12 16:50 +0200
            Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 17:50 +0200
              Re: Anti-malware for my personal Debian workstation? Celejar <celejar@gmail.com> - 2020-04-12 18:30 +0200
                Re: Anti-malware for my personal Debian workstation? <tomas@tuxteam.de> - 2020-04-12 20:50 +0200
              Re: Anti-malware for my personal Debian workstation? John Hasler <jhasler@newsguy.com> - 2020-04-12 19:40 +0200

Page 2 of 2 — ← Prev page 1 [2]

#221261

[Multipart message — attachments visible in raw view] — view raw

On Du, 12 apr 20, 09:17:18, tomas@tuxteam.de wrote:
> On Sun, Apr 12, 2020 at 09:52:50AM +0300, Andrei POPESCU wrote:
> 
> [...]
> 
> > There are sufficient tutorials advising to download random scripts and 
> > run with root privileges.
> 
> My fave still is
> 
>   curl https://random.site.net/script | sudo bash
> 
> And there are still people out there who even advocate it [1].
> 
> I think I was three when my mom taught me not to stuff random scripts
> ...uh stuff I found on the street into my mouth.

Excelent analogy :)
 
> Cheers
> [1] https://gist.github.com/btm/6700524

Thanks for that, I haven't thought of the potential for unintended 
damage mentioned in the comments (e.g. due to incomplete download, 
overriding already installed software, etc.).

>     (but then, it's Github, so Microsoft, so what do you expect?)
>     (Yah, I know this gist probably predates takeover, So what?)

Unless the platform (owner) is curating the content its not fair to 
blame it on them. There's enough out there to blame Microsoft for, this 
is *until now* not one of them.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#221268

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 12, 2020 at 11:37:24AM +0300, Andrei POPESCU wrote:
> On Du, 12 apr 20, 09:17:18, tomas@tuxteam.de wrote:

[...]

> > ...uh stuff I found on the street into my mouth.
> 
> Excelent analogy :)

:-)

> >     (but then, it's Github, so Microsoft [...])

> Unless the platform (owner) is curating the content its not fair to 
> blame it on them. There's enough out there to blame Microsoft for, this 
> is *until now* not one of them.

In a strict sense, you are right, and I conceded that in my next
remark:

> >     (Yah, I know this gist probably predates takeover, So what?)

But in a more general sense...

 - the snotty way to put it is that they have the Midas touch
   (just it's not gold things turn into at their touch, alas).
   If you want to know more about the Midas touch, do read on
   the strange story of Steven Elop, Nokia and Microsoft.

 - the more philosophical way would be to go philosophical about
   cultural hegemony, framing and dominance of discourse. Because
   you won't convince me that Microsoft shelled out $7B of their
   investor's money due to sheer Goodness of their Hearts.

Or something :-)

Cheers
-- tomás

[toc] | [prev] | [next] | [standalone]

#221277

[Multipart message — attachments visible in raw view] — view raw

On Du, 12 apr 20, 10:52:08, tomas@tuxteam.de wrote:
> 
> But in a more general sense...
> 
>  - the snotty way to put it is that they have the Midas touch
>    (just it's not gold things turn into at their touch, alas).
>    If you want to know more about the Midas touch, do read on
>    the strange story of Steven Elop, Nokia and Microsoft.

I am a strong believer of Hanlon's razor.

https://en.wikipedia.org/wiki/Hanlon%27s_razor

>  - the more philosophical way would be to go philosophical about
>    cultural hegemony, framing and dominance of discourse. Because
>    you won't convince me that Microsoft shelled out $7B of their
>    investor's money due to sheer Goodness of their Hearts.

So far it seems Microsoft's intention is to use Github to host its own 
Open Source software while also making a profit from it. Nothing wrong 
with any of that.

Could Github disappear at some point due to bad management? Sure it 
could, just as well as with any other owner. There is no guarantee that 
it would have done better without Microsoft.

Could Microsoft at some point change hosting policies or even close it 
down completely? Sure they can, and they would be fully within their 
rights as owner trying to make a profit.

Would that make like harder for projects hosted there? Sure it will, 
they might need to migrate, and not only the repositories themselves, 
but also issues, pages, etc.

Will the software disappear due to that? Unlikely in my opinion, even if 
only due to git's distributed nature (local checkouts are in general 
full clones).

The acquisition by Microsoft also served as a reminder that no one 
platform is guaranteed to exist forever.

It also helped increase the popularity of Gitlab (and others) which in 
addition to a hosting platform is also (mostly) free software that can 
be deployed on own infrastructure (as Debian does). That was actually 
quite a good outcome :)

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#221278

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 12, 2020 at 12:40:06PM +0300, Andrei POPESCU wrote:
> On Du, 12 apr 20, 10:52:08, tomas@tuxteam.de wrote:
> > 
> > But in a more general sense...
> > 
> >  - the snotty way to put it is that they have the Midas touch

[...]

> I am a strong believer of Hanlon's razor.
> 
> https://en.wikipedia.org/wiki/Hanlon%27s_razor

I'm usually too, but within limits. There's also this bastard
of Clarke's Third Law and Hanlon's Razor:

  "Any sufficiently advanced malice is indistinguishable
   from stupidity".

> >  - the more philosophical way would be to go philosophical about
> >    cultural hegemony [...]

> So far it seems Microsoft's intention is to use Github to host its own 
> Open Source software while also making a profit from it. Nothing wrong 
> with any of that.

Yah, but $7B is a hell of a lot of money. Do we know how much
Github makes a year?

> Could Github disappear at some point due to bad management? Sure it 
> could, just as well as with any other owner. There is no guarantee that 
> it would have done better without Microsoft.
>
> Could Microsoft at some point change hosting policies or even close it 
> down completely? Sure they can, and they would be fully within their 
> rights as owner trying to make a profit.
> 
> Would that make like harder for projects hosted there? Sure it will, 
> they might need to migrate, and not only the repositories themselves, 
> but also issues, pages, etc.
> 
> Will the software disappear due to that? Unlikely in my opinion, even if 
> only due to git's distributed nature (local checkouts are in general 
> full clones).

I do strongly agree on all of those points. My blathering about
cultural hegemony and that is just: mindshare. People already
believed that git "is Github" (at my old workplace, most people
didn't know the difference). That's what imho worth $7B to Microsoft.
If they succeed in driving that nail deeper, the more, the merrier.

As a free software advocate, I'd like to see that nail go away,
as you might understand :-)

> The acquisition by Microsoft also served as a reminder that no one 
> platform is guaranteed to exist forever.
> 
> It also helped increase the popularity of Gitlab (and others) which in 
> addition to a hosting platform is also (mostly) free software that can 
> be deployed on own infrastructure (as Debian does). That was actually 
> quite a good outcome :)

Yah, but :)

This wouldn't have happened without Microsoft having the bad reputation
it already has, and that's why I see it as my responsibility to remind
people of all those episodes: the mentioned Nokia thing. The ballot
stuffing in the OOXML standardization process. And all those little,
nasty worsenings of open standards to gain some market advantage.

Granted, "the others" are as bad, but size and longevity matter.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#221289

[Multipart message — attachments visible in raw view] — view raw

On Du, 12 apr 20, 12:05:28, tomas@tuxteam.de wrote:
> On Sun, Apr 12, 2020 at 12:40:06PM +0300, Andrei POPESCU wrote:
> 
> > So far it seems Microsoft's intention is to use Github to host its own 
> > Open Source software while also making a profit from it. Nothing wrong 
> > with any of that.
> 
> Yah, but $7B is a hell of a lot of money. Do we know how much
> Github makes a year?

Microsoft has been moving to the cloud and buying Github seems to be 
part of the same direction. Github might not need to make a profit in 
order to benefit Microsoft's profits,

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#221302

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 12, 2020 at 04:04:23PM +0300, Andrei POPESCU wrote:
> On Du, 12 apr 20, 12:05:28, tomas@tuxteam.de wrote:
> > On Sun, Apr 12, 2020 at 12:40:06PM +0300, Andrei POPESCU wrote:
> > 
> > > So far it seems Microsoft's intention is to use Github to host its own 
> > > Open Source software while also making a profit from it. Nothing wrong 
> > > with any of that.
> > 
> > Yah, but $7B is a hell of a lot of money. Do we know how much
> > Github makes a year?
> 
> Microsoft has been moving to the cloud and buying Github seems to be 
> part of the same direction. Github might not need to make a profit in 
> order to benefit Microsoft's profits,

But that was my point: Github's value for them is mindshare, or
cultural hegemony, call it what you like.

And I don't like them having mindshare... based on 30+ years of
experience.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#221331

[Multipart message — attachments visible in raw view] — view raw

On Du, 12 apr 20, 15:45:10, tomas@tuxteam.de wrote:
> > 
> > Microsoft has been moving to the cloud and buying Github seems to be 
> > part of the same direction. Github might not need to make a profit in 
> > order to benefit Microsoft's profits,
> 
> But that was my point: Github's value for them is mindshare, or
> cultural hegemony, call it what you like.

I meant as part of their offer of cloud services, by making the entire 
package more attractive. Oh well...

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#221323

On Sunday 12 April 2020 09:04:23 Andrei POPESCU wrote:

> On Du, 12 apr 20, 12:05:28, tomas@tuxteam.de wrote:
> > On Sun, Apr 12, 2020 at 12:40:06PM +0300, Andrei POPESCU wrote:
> > > So far it seems Microsoft's intention is to use Github to host its
> > > own Open Source software while also making a profit from it.
> > > Nothing wrong with any of that.
> >
> > Yah, but $7B is a hell of a lot of money. Do we know how much
> > Github makes a year?
>
> Microsoft has been moving to the cloud and buying Github seems to be
> part of the same direction. Github might not need to make a profit in
> order to benefit Microsoft's profits,
>
> Kind regards,
> Andrei

This might also be true. But at the risk of stating the obvious, if 
github gets forked by an open source advocate, I'd sure investigate 
moving our open source efforts away from the M$ tentacles.  This war is 
not done as it has the odor of embrace tightly enough to suffocate and 
extinguish which has been the M$ goal all along.

Some how, the tigers inability to change its strips will be displayed.

In the meantime, stay well everybody.

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#221327

[Multipart message — attachments visible in raw view] — view raw

On Du, 12 apr 20, 11:26:18, Gene Heskett wrote:
> 
> This might also be true. But at the risk of stating the obvious, if 
> github gets forked by an open source advocate, I'd sure investigate 
> moving our open source efforts away from the M$ tentacles.

As far as I know the software behind the Github platform is and always 
was proprietary (except for git, of course), so there is nothing to 
fork.

If you need alternatives to Github have a look at Gitlab, which is 
available both as a service and a software to host yourself.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#221313

On Sun, 12 Apr 2020 11:37:24 +0300
Andrei POPESCU <andreimpopescu@gmail.com> wrote:

> On Du, 12 apr 20, 09:17:18, tomas@tuxteam.de wrote:
> > On Sun, Apr 12, 2020 at 09:52:50AM +0300, Andrei POPESCU wrote:
> > 
> > [...]
> > 
> > > There are sufficient tutorials advising to download random scripts and 
> > > run with root privileges.
> > 
> > My fave still is
> > 
> >   curl https://random.site.net/script | sudo bash
> > 
> > And there are still people out there who even advocate it [1].
> > 
> > I think I was three when my mom taught me not to stuff random scripts
> > ...uh stuff I found on the street into my mouth.
> 
> Excelent analogy :)
>  
> > Cheers
> > [1] https://gist.github.com/btm/6700524
> 
> Thanks for that, I haven't thought of the potential for unintended 
> damage mentioned in the comments (e.g. due to incomplete download, 
> overriding already installed software, etc.).

Interesting discussion. I've looked quickly at the other side [1],
however, and there seem to be serious people and arguments in that
direction as well. Are they so obviously wrong? [The objection Andrei
notes here is specifically countered by the "curl | bash" defenders,
although even I can see that the counter is not as strong as the
objection.]

[1]
https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install
https://news.ycombinator.com/item?id=12766049

Celejar

[toc] | [prev] | [next] | [standalone]

#221328

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 12, 2020 at 10:41:12AM -0400, Celejar wrote:
> On Sun, 12 Apr 2020 11:37:24 +0300
> Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> 
> > On Du, 12 apr 20, 09:17:18, tomas@tuxteam.de wrote:
> > > On Sun, Apr 12, 2020 at 09:52:50AM +0300, Andrei POPESCU wrote:

[...]

> Interesting discussion. I've looked quickly at the other side [1],
> however, and there seem to be serious people and arguments in that
> direction as well. Are they so obviously wrong? [The objection Andrei
> notes here is specifically countered by the "curl | bash" defenders,
> although even I can see that the counter is not as strong as the
> objection.]
> 
> [1]
> https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install
> https://news.ycombinator.com/item?id=12766049

It boils down to whom you trust. Actually the sandstorm page is
a bit too much marketing-ish for my taste:

  "Some of the objectors, though, go a bit further: They claim
   that curl|bash is more open to attack that other distribution
   mechanisms [...]

   Of course, all content served by sandstorm.io – from software
   downloads to our blog – is served strictly over HTTPS [...]"

They are mixing up the chain of trust up to the distributor (package
signing) with the transport secutity (HTTPS). Why?

Remember that nice npm event-stream messup [1]? That's the dark
side of "iterate faster".

Trust is a complex beast. At its bottom it can't be completely
rational, but usually you trust a community because you somehow
think you understand how it works and you trust the information
chain linking you to that community.

Cheers
[1] https://lwn.net/Articles/773121/
-- tomás

[toc] | [prev] | [next] | [standalone]

#221338

On Sun, 12 Apr 2020 17:41:54 +0200
<tomas@tuxteam.de> wrote:

> On Sun, Apr 12, 2020 at 10:41:12AM -0400, Celejar wrote:
> > On Sun, 12 Apr 2020 11:37:24 +0300
> > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> > 
> > > On Du, 12 apr 20, 09:17:18, tomas@tuxteam.de wrote:
> > > > On Sun, Apr 12, 2020 at 09:52:50AM +0300, Andrei POPESCU wrote:
> 
> [...]
> 
> > Interesting discussion. I've looked quickly at the other side [1],
> > however, and there seem to be serious people and arguments in that
> > direction as well. Are they so obviously wrong? [The objection Andrei
> > notes here is specifically countered by the "curl | bash" defenders,
> > although even I can see that the counter is not as strong as the
> > objection.]
> > 
> > [1]
> > https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install
> > https://news.ycombinator.com/item?id=12766049
> 
> It boils down to whom you trust. Actually the sandstorm page is
> a bit too much marketing-ish for my taste:
> 
>   "Some of the objectors, though, go a bit further: They claim
>    that curl|bash is more open to attack that other distribution
>    mechanisms [...]
> 
>    Of course, all content served by sandstorm.io – from software
>    downloads to our blog – is served strictly over HTTPS [...]"
> 
> They are mixing up the chain of trust up to the distributor (package
> signing) with the transport secutity (HTTPS). Why?
> 
> Remember that nice npm event-stream messup [1]? That's the dark
> side of "iterate faster".
> 
> Trust is a complex beast. At its bottom it can't be completely
> rational, but usually you trust a community because you somehow
> think you understand how it works and you trust the information
> chain linking you to that community.

Exactly. So if I trust the Sandstorm community (for example - I know
nothing about them), then I'm not sure that there's any particularly
great risk in installing their product via "curl | bash", and if I
don't trust them, I shouldn't install their product via any other
mechanism either.

> Cheers
> [1] https://lwn.net/Articles/773121/
> -- tomás


Celejar

[toc] | [prev] | [next] | [standalone]

#221345

[Multipart message — attachments visible in raw view] — view raw

On Sun, Apr 12, 2020 at 12:25:16PM -0400, Celejar wrote:

[...]

> Exactly. So if I trust the Sandstorm community (for example - I know
> nothing about them), then I'm not sure that there's any particularly
> great risk in installing their product via "curl | bash", and if I
> don't trust them, I shouldn't install their product via any other
> mechanism either.

That's it. OTOH, for me (YMMV), trust depends on how I perceive
their efforts to set up a (to me, again) meaningful security
infrastructure.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#221339

 tomás writes:
> Trust is a complex beast. At its bottom it can't be completely
> rational, but usually you trust a community because you somehow think
> you understand how it works and you trust the information chain
> linking you to that community.

You can also trust a community because it's hard for one to keep a
secret (harder for some sorts of communities than others).
-- 
John Hasler 
jhasler@newsguy.com
Elmwood, WI USA

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web