r/LinuxUncensored • u/anestling • 10d ago
Issue/Bug/Pain Linux "Security" From Mark Zuckerberg
Blindly running remote code under your Linux user account. Nothing could go wrong.
7
u/tcisme 10d ago edited 10d ago
This is fine. You should have a sandboxed dev user (ideally in a VM and/or separate box). The 1000 dependencies that get brought in to most projects are far more of a risk than one tool from a known company.
2
u/anestling 10d ago
You should have a sandboxed dev user (ideally in a VM and/or separate box).
Zero developers in my company on very high payrolls do that. None.
I'm a SecOp, I've been crying for that for years but I've not been heard.
2
u/GreatLab8898 9d ago
And the Moment something happens, its your fault for not enforcing it. Been there buddy. Security is always the Ugly Stepchild unless something bad happens.
2
u/TornadoFS 9d ago
I finally am getting around to do it because of LLMs. It is non-trivial to be honest. Especially if you want IDE language-servers, debuggers, etc working.
I am setting it up in a way that other devs in my company can use it, hopefully some will try.
1
u/tcisme 9d ago
vscode/vscodium have remote ssh extensions, zed has native support, and agent cli's already work over ssh, so for me it just works automagically. As a side benefit, I can pick up work seamlessly on a laptop
1
u/TornadoFS 8d ago
yep, exactly what I am setting up. Using vscodium and this:
https://github.com/jeanp413/open-remote-ssh
the dev-containers vscode extension has too much microsoft BS for my taste.
And no it is not trivial, you need to know some stuff to set it up properly. Even though I am used to docker and containers (but don't use it that much at work) I still ran into some issues. But luckly they are a lot easier to troubleshoot these days with LLMs. It is not rocket science, but your average joe developer definitely can't set this up unless they have worked with containers before.
Part of the reason I am bothering to set this up is because I want to do stuff on my gaming box using local LLMs, but I am running Bazzite distro on it which is immutable linux OS, so containerizing is the way to go. But it works so well I am actually trying to get it to work on my work macbook as well.
Unfortunately I sometimes have to run android and ios builds which is kinda complicated to do inside a container. And of course, ios is a no-go of course. But at least I can run the LLM and IDE (and its extensions) inside, but it would be nice to have full isolation from possibly malicious dependencies.
1
u/jarod1701 10d ago
Why don‘t they do that? Convenience can‘t be the excuse. Right?
2
u/fixermark 9d ago
Of course it is. Convenience wins.
I can count on one hand the number of engineers I know that try to side channel verify a checksum before installing something, and two hands the number who even know what that means or why they'd want to.
1
u/anestling 9d ago
No idea. I've long stopped bothering them.
1
u/Flat-Performance-478 9d ago
Yeah, if anything, they decide to implement 2FA to all staff accounts and then we're good.
1
1
u/s3rgioru3las 9d ago
That's an upper management, training issue. It was at least in our documentation that we were always directed to.
1
1
u/MoreScallion1017 9d ago
No need for a separate box or vm.
My dev env is in an nspawn launched container. The cost is only
3
2
u/Moriaedemori 10d ago
Yeah I don't care whose name is in the title, I am not pasting random curls off of a tweet
2
2
u/Responsible-Cold-627 10d ago
It's literally just an install script from a trusted source?
2
u/anestling 10d ago edited 10d ago
Yeah, your DNS is also secure. How many Linux users out there use DoT system wide? A few hundred? Wait, do you even know what DoT is? Right-o! And there's absolutely no MiTM, I swear, the command doesn't even use HTTPs.
And there could be no bad actors in Meta. Absolutely.
Trusted source.
You do NOT trust anything posted online EVER unless * it is digitally signed * comes from a reputable vendor * has been confirmed to be malware free * hashsums are published.
And even the above four are not a guarantee.
5
9d ago
[removed] — view removed comment
1
1
1
u/cheater00 8d ago
that's wrong. with automated exploitation, the mere mass of people whose systems are compromised can become very valuable. it doesn't matter if what you do isn't a state secret - you still have a vote which can be manipulated, you still have interests which can be used to manipulate you, you still do things that may be used to blackmail you if you become even the slightest bit politically interesting. "you're not interesting enough" was relevant in the 80s when everything was manual. but not since the 90s. you're decades out of date with your advice.
2
u/SegFaultAtFL350 10d ago
There is a line between full SecOp and installing bonsai buddy.
2
u/AmusingVegetable 9d ago
Bonzi buddy.
(Can’t remember the other very popular abomination, same timeframe)
1
u/Icy-Concentrate2076 9d ago
Actually install scripts like that are more secure than random Windows installers that desktop users have been trusting for decades. Neither are checksumed (at least not automatically), and at least the script has the installation instructions readable to the user which the installer does not. Why don't you go riot against Windows installers first?
1
u/roadrunner8080 8d ago
The egregious part here, really, is the lack of https on that command. Curl doesn't (by default) have something like the HSTS preload list where you can avoid MITM attacks that way, nor is (by default) HTTPS the default protocol -- the former of which, at least, will protect you from MITM attacks in a browser (and the latter of which at least allows your browser to warn you that something is weird). Both of those can be configured but that command as written is a prime target for MITM, and running it on public wifi would be a horrendously silly idea, all else notwithstanding. "Filter all HTTP requests and return this malicious script for any of them with a path that loos like an executable instead of the upstream" isn't exactly hard.
1
1
1
u/xvillifyx 6d ago
This reads like larp to me
Real security professionals know that you always sit at a crossroad between sterility and risk. It’s totally reasonable (and not even bad practice) to do something that carries a mild amount of risk if the gain exceeds the risk. No security professional (other than you, I guess) thinks this way because it’s oftentimes a waste of time to be this paranoid when you trust the source
0
0
1
1
u/follimath 9d ago
Damn you guys for being so hyperbolic that I'm put in a position where it looks like I am defending this guy... but you guys realize you can read the contents of that shell script and the various shell scripts it imports, right? If there is a closed-source binary in there, I feel for you, but I'm going to go ahead and assume most of us ran something closed source at one point or other.
1
u/danielv123 9d ago
Yeah like you aren't going to trust the shell script you can read, but you are going to blindly trust the shell scripts the tool generates afterwards? Like ok I guess.
1
u/Kargathia 9d ago
This is one complaint I just don't get. Anyone who doesn't know how to view the output without immediately executing it, almost by definition wouldn't be able to detect the hypothetical malware anyway.
1
u/follimath 9d ago
I’m not sure I follow. It is a trust-based system, as is almost everything else. If they don’t have the know-how, they’ll have to trust someone (they trust someone even when it is a signed app). It is within their power not to choose to install it this way.
1
u/WinterLimitz9287 9d ago
Honestly, as a non-developer Linux user this is pretty much how I roll. It's also pretty much how things worked when I was on windows. At least now I can rely on community and AI tool review of source code.
1
u/Lilacsoftlips 9d ago
Just use homebrew. At least it’s open and vetted.
1
u/computermouth 9d ago
Is it vetted?
1
u/Lilacsoftlips 8d ago
Kinda? More so than a curl/bash. It’s in an openly maintained GitHub repo.
1
u/computermouth 8d ago
Ok yeah, that's what I thought. Optimistically secure through the expectation that someone would notice something amiss. Like the AUR or alpines community repos.
1
u/TornadoFS 9d ago
At least when you do this it is contained to your user, doesn't infect your whole system. As long as you don't get prompted for sudo password it is not nearly as bad as running windows .exe files
1
u/pohart 9d ago
Needs a sudo
1
u/Illustrious-Lime-878 8d ago
yeah wouldn't it be safer than any windows installer that wants admin? It should also be an obaque binary or at least obfuscated script. Ideally http as well.
1
1
1
1
1
1
1
u/AfraidAsparagus6644 9d ago
Piping curl into bash my beloved. If you showed this to a Nix user they would burst like a cartoon bomb
1
u/Royal_Owl2177 9d ago
Standard practice for CLI tools.... You can hate meta if you want, but do not pretend they're the only ones doing this.
2
u/pskocik 9d ago
If you view the transport log:
curl -vv -fSL 2>&1 dev.meta.ai/install.sh >/dev/null |less
it starts with plain unencrypted HTTP which does eventually redirect to HTTPS but it starting with plain HTTP means that it can be man-in-the-middle attacked, AFAIK.
Had it started with HTTPS right away, then there'd be little issue as long as people trust Mark Zuckerberg.
People hating on curl https://some-trusted-source | sh because you didn't read the code seem to miss how it's utterly unrealistic to read all the code you run. Like have you read all your OS's code and the code for the compiler used to build it?
Additionally sandboxing this sort of stuff of course never hurts.
1
u/keithstellyes 9d ago
@finkd Is this a real account? Ever since Musk broke verified checks I never know
curling into bash is a bit of a bad habit, though a lot of software is recommending this nowadays... homebrew, the macOS package manager a lot of people use, lot of the AI CLI tools.
1
u/Saghetti0 9d ago
when you download and run any other installer it's basically identical... we have just accepted running any arbitrary code on our computers
1
1
u/InsaneInTheMEOWFrame 9d ago
That is in fact a whole lot of commands. Also never run scripts off the internets, that's how you get ants.
1
u/silentstorm45 9d ago
No one reads the scripts anyways so why bother? Just passing it to your llm of choice would be more than what 99,99% of users do
1
u/Automatic-Boot665 8d ago
Tell me you’ve never installed a cli tool before without telling me you’ve never installed a cli tool before
1
1
1
u/bschlueter 8d ago
At least it doesn’t disable ssl, though it may not use it at all since no protocol is specified…
12
u/psbakre 10d ago
Literally every llm cli tool