Post B7Mv2OYOGAVIBrVjkm by anthropy@mastodon.derg.nz
(DIR) More posts by anthropy@mastodon.derg.nz
(DIR) Post #B7MtBy8D9UQrEMhf3Q by anthropy@mastodon.derg.nz
1 likes, 1 repeats
It's easy to dunk on Arch's #AUR issues while ignoring what's going on.- It involves some accounts that have been around for years, this is a sophisticated and well-planned attack.- As much as AUR is very central to Arch, every big distro has its own 'alternative' package platform, like Fedora's Copr and Ubuntu's PPAs.- Despite early discovery and coordinated efforts, it is still ongoing.I think the rest of the ecosystem should take this as a warning.Linux is not just magically secure.
(DIR) Post #B7MtBynKgbKFHtwV9M by anthropy@mastodon.derg.nz
0 likes, 1 repeats
And note that that's not to say "Linux isn't secure".It's to say that with Windows rapidly losing relevance, Linux is going to only get more and more of a lens on it.APTs, fuzzing tools, security analyzers, LLMs, the list of new threats is growing rapidly.The time from finding issues to active exploitation in the wild has gone from years to hours over the last decade. I posted about that recently too https://mastodon.derg.nz/@anthropy/116603425961416267The world has never been secure, just ask anyone in cybersecurityRT: https://mastodon.derg.nz/users/anthropy/statuses/116603425961416267
(DIR) Post #B7MtBz19rCNtymPXhQ by icedquinn@blob.cat
0 likes, 0 repeats
@anthropy i posted a bit a while back about how supply chain security is a bit expensive to actually do. most of its just corporate theatre.to do it but actually involves like, reproducible builds + pgp web of trust signing + decentralized distribution, which is all doable but people just like. don't actually care that much. :gutkato_xD:
(DIR) Post #B7MtBzJElyqWsqrysa by anthropy@mastodon.derg.nz
0 likes, 0 repeats
And, note that this is ALSO not to say "we're all doomed" or whatever.It's simply to say we need to take this seriously.We can't just sit and point and laugh while allies are getting attacked. We are in this together. Find ways we can help each other forward.If you wanted to learn more about cybersecurity, now seems to be an excellent time.What are you doing to keep your data safe? How are your backups (that you're not keeping on the same device)? Do you need help with any of this?
(DIR) Post #B7Mu9ijVX37MqedkQq by anthropy@mastodon.derg.nz
0 likes, 0 repeats
@icedquinn I think a lot of distros are doing well in this sense, arch isn't as much but honestly the main attack vector was AUR here, not the main repos (although it could still become that one day).I do still wonder if security is going to be something people actively care about some day, more than just features. it feels like we're heading into a time where it's unavoidable, but I guess we'll see when the stuff on VNCresolver starts disappearing :P
(DIR) Post #B7Mu9ixggKSbYdH4XA by icedquinn@blob.cat
0 likes, 0 repeats
@anthropy i doubt it. there's nothing in psychology that suggests people are going to all the sudden care about proactive things when they already generally don't and haven't for decades.the general neurotypical apparatus is even hostile to this in numerous ways; ex. pointing out similarities of policy with bad ideas -> "that's just slippery slope fallacy," or how pointing out flippers are revealing how exploitable canada is met with "canada bans flipper zeroes," and the general behaviorism of correct criticism is still met with, generally, containing the critic to remove from the clique to protect the good feels.the technical aspects exist and are formally verifiable (TLA+/fizzbee model :comfyderp:) as far as reproducible builds mean auditors don't have to coordinate, just audit, compile and sign, the web of trust discharges evil auditors being in on the scam, and general mirror/torrenting/ipfs is great at disseminating the bits, but it still requires people to do the work and it still means you have to pick which auditors you do trust.i tried explaining the scheme a few times and people just went on talking points showing how they clearly misunderstood the assignment, so i shrugged. the interesting part was solved. getting people to understand is its own hell that always takes much longer than writing the patch.
(DIR) Post #B7MuMOVs1LEjtyIxIe by icedquinn@blob.cat
0 likes, 0 repeats
@anthropy under the same analysis, TUF/cosign ends up not accomplishing much other than installing big tech as a signing authority. it doesn't actually secure anything, it just puts github and google in control of signing keys (through the OIDC layer) and everyone feels good about themselves because there's a blockchain somewhere.
(DIR) Post #B7Mv2OYOGAVIBrVjkm by anthropy@mastodon.derg.nz
0 likes, 0 repeats
@icedquinn I mean people ignoring it has been the case so far, definitely. At most when it's convenient as an empty promise on a big tech product. But losing everything can be pretty convincing heh. in the era of ransomware and nothing being sacred, if people aren't going to care before it's too late, then they probably will afterwards.I can imagine it's tiring though, explaining it to people. I've left cybersecurity for a reason, long ago, but I have to say, it really feels like it's changing
(DIR) Post #B7Mv2Osx1iwzDd89nk by icedquinn@blob.cat
0 likes, 0 repeats
@anthropy i think you would have to see some particularly obnoxious people intervene for that kind of change. as long as "slather PR on it" is a viable strategy, as is "buy some insurance about it," there will still be calculus about prioritizing showy KPIs over "the operational budget is higher than our competitors because we have never been hacked," which isn't something that makes hedge funds happy when they bought all the stocks and hollowed the board out because they don't know anything and just need number bigger for the retirement account to make KPI (the competence crisis.)i still regularly have arguments with people about how medical insurance is not a solution to the supply problem, Taleb's books kind of wave about finance similarly finding ways to just rely on insurance, handwave away actual risk, and harvest bailouts when all else fails.like its possible to do but you're slamming against the grain very hard.
(DIR) Post #B7MvKJkWrPLmVEjcQ4 by icedquinn@blob.cat
0 likes, 0 repeats
@anthropy > how to source packages safely.shuttling the bits is solved, identity isn't so much. my proposal does complicate attacks greatly, but also people just really aren't going to do the effort for 30 stars on github projects.probably the most realistic outcome is put an end to C-like coding and make shit like bubblewrap in ada/spark or lean and then rely on sandboxes for things too small to audit, or otherwise just accept its going to pop off at times.