Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #232359

Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems]

From Celejar <celejar@gmail.com>
Newsgroups linux.debian.user
Subject Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems]
Date 2021-03-04 17:20 +0100
Message-ID <BOYRH-cF-1@gated-at.bofh.it> (permalink)
References (6 earlier) <BOSMh-4zZ-1@gated-at.bofh.it> <BOW3v-6Mm-3@gated-at.bofh.it> <BOW3v-6Mm-1@gated-at.bofh.it> <BOX9f-7nW-5@gated-at.bofh.it> <BOXVE-7Tw-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Thu, 4 Mar 2021 16:14:08 +0100
tomas@tuxteam.de wrote:

> On Thu, Mar 04, 2021 at 09:21:46AM -0500, Celejar wrote:
> > On Thu, 4 Mar 2021 14:17:59 +0100
> > <tomas@tuxteam.de> wrote:
> > 
> > > On Thu, Mar 04, 2021 at 08:10:45AM -0500, Celejar wrote:
> > > > On Thu, 4 Mar 2021 09:41:13 +0000
> > > > Joe <joe@jretrading.com> wrote:
> > > > 
> > > > ...
> > > > 
> > > > > Undoubtedly. But there is also no doubt that gcc and every other
> > > > > serious compiler in the West has been compromised. Why would they *not*
> > > > > be?
> > > > 
> > > > Do you have any evidence for this, or is it just your assumption,
> > > > because "why would they not be?"
> > > 
> > > You mean GCC specifically or some examples of build chain attacks
> > > in general? Because in the second case there are some nice specimens
> > > out there.
> > 
> > I'm interested in anything, although my comment was focused
> > particularly on things as critical, fundamental, and ubiquitous as GCC
> > and "every other serious compiler."
> 
> Two off the top of my head
> 
> - Sometime 2017 [1], Microsoft put out a version of Visual Studio
>   which baked "phone home" functionality into its compiled "products".
>   Make no mistake: it phoned Microsoft. Imagine you compile an
>   application for your customer, and this app phones... Microsoft.
> 
>   Some hilarity ensued. They said "oh, sorry. It wasn't with bad
>   intentions" and reverted it.
> 
>   I call this pattern "Emergent Evil".

Outrageous, certainly - this sort of thing is one of the reasons I
use linux and avoid Microsoft products to the extent I find practical.
But I don't consider this a "build-chain attack."

> - NPM buildchain attacks are more and more frequent. Just publish
>   a package out there and wait until someone takes the bait.
>   An especially nice one was the event-stream [2] episode, where
>   the malicious code only injected malicious code (yes, really)
>   when it noticed that it was "in" the right build environment.
>   Nice read. I'm sure this ain't the only one in this context.

Agreed - this sort of thing is scary. I know I can't avoid the risk
entirely, but this is one of the reasons I try hard to limit my use of
software to stuff in the repos. I understand it's no magic bullet
against this type of thing, but in my (not very informed) judgment, it's
less likely to happen to stuff that Debian is vetting. I.e., I'm hoping
that all those hoops that Debian makes packages jump through, which
prevent stuff I do want from entering the repos, will work here in my
favor ;)

> Note that I'm no specialist. Otherwise the top of my head would
> be heavier ;-)
> 
> Cheers
> 
> [1] https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_adding_telemetry_function_calls_to/
> [2] https://lwn.net/Articles/773121/

Celejar

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-02 21:10 +0100
  Re: Installation problems Brian <ad44@cityscape.co.uk> - 2021-03-02 21:40 +0100
    Re: Installation problems Weaver <weaver@riseup.net> - 2021-03-02 22:20 +0100
      Re: Installation problems <tomas@tuxteam.de> - 2021-03-02 22:30 +0100
        Re: Installation problems Brian <ad44@cityscape.co.uk> - 2021-03-03 00:10 +0100
    Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-02 22:50 +0100
      Re: Installation problems "Andrew M.A. Cater" <amacater@einval.com> - 2021-03-02 23:20 +0100
        Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 02:40 +0100
          Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 02:50 +0100
      Re: Installation problems Keith Bainbridge <ke1thozgroups@gmx.com> - 2021-03-03 00:00 +0100
        Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 10:30 +0100
          Re: Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-03 15:40 +0100
            Re: Installation problems Celejar <celejar@gmail.com> - 2021-03-03 16:40 +0100
            Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 16:40 +0100
              Re: Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-03 22:40 +0100
                Re: Installation problems Joe <joe@jretrading.com> - 2021-03-03 23:00 +0100
                Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-04 13:00 +0100
                Re: Installation problems Tixy <tixy@yxit.co.uk> - 2021-03-04 13:30 +0100
                Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-04 14:00 +0100
                Re: Installation problems Felix Miata <mrmazda@earthlink.net> - 2021-03-04 17:30 +0100
    Re: Installation problems Keith Bainbridge <ke1thozgroups@gmx.com> - 2021-03-02 23:50 +0100
      Re: Installation problems David Wright <deblis@lionunicorn.co.uk> - 2021-03-03 03:50 +0100
        Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 10:50 +0100
          Re: Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 11:20 +0100
    Re: Installation problems Keith Bainbridge <ke1thozgroups@gmx.com> - 2021-03-03 00:00 +0100
  PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-03 16:30 +0100
    Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-03 22:30 +0100
      Re: PARTIAL DIAGNOSIS of Installation problems Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-03 23:00 +0100
        Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 02:50 +0100
          Re: PARTIAL DIAGNOSIS of Installation problems Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-04 03:50 +0100
            Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 04:20 +0100
              Re: PARTIAL DIAGNOSIS of Installation problems Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-04 05:10 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems <tomas@tuxteam.de> - 2021-03-04 10:00 +0100
          Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] <tomas@tuxteam.de> - 2021-03-04 09:50 +0100
            Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Joe <joe@jretrading.com> - 2021-03-04 10:50 +0100
              Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] <tomas@tuxteam.de> - 2021-03-04 14:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 15:30 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] tomas@tuxteam.de - 2021-03-04 16:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 17:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] tomas@tuxteam.de - 2021-03-04 19:10 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 19:30 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-04 23:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] <tomas@tuxteam.de> - 2021-03-04 23:40 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Joe <joe@jretrading.com> - 2021-03-04 23:50 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 15:30 +0100
              Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 14:20 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Joe <joe@jretrading.com> - 2021-03-04 16:10 +0100
                Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation  problems] Celejar <celejar@gmail.com> - 2021-03-04 17:20 +0100
                OT: Bathroom scales (was: Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems]) rhkramer@gmail.com - 2021-03-04 17:40 +0100
            Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 23:30 +0100
              [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-05 04:00 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of  Installation problems] David Christensen <dpchrist@holgerdanske.com> - 2021-03-05 06:30 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of  Installation problems] David Christensen <dpchrist@holgerdanske.com> - 2021-03-05 06:40 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Stefan Monnier <monnier@iro.umontreal.ca> - 2021-03-05 07:40 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of  Installation problems] <tomas@tuxteam.de> - 2021-03-05 09:20 +0100
                Re: [OFFTOPIC] Re: Trusting trust [was: PARTIAL DIAGNOSIS of Installation problems] Gene Heskett <gheskett@shentel.net> - 2021-03-05 15:10 +0100
    Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-04 13:30 +0100
      Re: PARTIAL DIAGNOSIS of Installation problems David Wright <deblis@lionunicorn.co.uk> - 2021-03-04 18:50 +0100
      Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-04 23:50 +0100
        Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-05 13:20 +0100
          Re: PARTIAL DIAGNOSIS of Installation problems David Christensen <dpchrist@holgerdanske.com> - 2021-03-05 21:30 +0100
            Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-05 22:20 +0100
              Re: PARTIAL DIAGNOSIS of Installation problems Joe <joe@jretrading.com> - 2021-03-05 22:50 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems Richard Owlett <rowlett@cloud85.net> - 2021-03-05 23:30 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems Charles Curley <charlescurley@charlescurley.com> - 2021-03-06 00:40 +0100
                Re: PARTIAL DIAGNOSIS of Installation problems Celejar <celejar@gmail.com> - 2021-03-07 01:40 +0100
    Re: PARTIAL DIAGNOSIS of Installation problems David Wright <deblis@lionunicorn.co.uk> - 2021-03-06 02:50 +0100
    Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-08 13:10 +0100
      Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} "Andrew M.A. Cater" <amacater@einval.com> - 2021-03-08 13:30 +0100
      Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} songbird <songbird@anthive.com> - 2021-03-08 17:30 +0100
        Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-08 20:20 +0100
          Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} songbird <songbird@anthive.com> - 2021-03-09 02:10 +0100
        Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-09 13:40 +0100
          Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Anssi Saari <as@sci.fi> - 2021-03-09 14:00 +0100
            Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Joe <joe@jretrading.com> - 2021-03-09 14:20 +0100
          Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-09 14:10 +0100
            Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Joe <joe@jretrading.com> - 2021-03-09 14:20 +0100
            Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-09 21:40 +0100
              Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-10 10:50 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-10 11:30 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-10 14:40 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Richard Owlett <rowlett@cloud85.net> - 2021-03-10 15:50 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} Andrei POPESCU <andreimpopescu@gmail.com> - 2021-03-10 21:50 +0100
                Re: Status update {Re: PARTIAL DIAGNOSIS of Installation problems} "Andrew M.A. Cater" <amacater@einval.com> - 2021-03-11 00:20 +0100

csiph-web