• 5 Posts
  • 17 Comments
Joined 1 year ago
cake
Cake day: September 13th, 2024

help-circle







  • DO NOT download and install random programs from the internet. Not a deb/rpm file, not an elf binary, not an install script, nothing. Use your package manager or desktop environment’s app store. At most use flatpak or snap packages.

    Linux gets its reputation for not getting malware from the same place Mac does: It has a managed app repository where you get all your software from. Difference is Mac doesn’t let you install arbitrary programs at all, while Linux expects you to know better than to do that. Someone who doesn’t know what they’re doing downloading Linux programs from random websites will inevitably hit one of the super rare Linux malware in the wild.

    Even ignoring security issues, running an install script even from a reputable open source project’s website can open you up to package dependency hell. And if you ever need to upgrade or modify it, you’re in for a rough time because none of the existing tools built into your distro will help you. It’s even worse than Windows when this happens because Windows at least expects for things like this to happen (because everything comes in its own installer and handles updates separately) and has UX elements to help non tech savvy users deal with their mess of apps, Linux expects anyone bypassing the normal package manager to know what they’re doing and if you don’t, it won’t be a good day for you.





  • Google managed to backdoor Linux and Firefox with their “FOSS” libWebp. Took literally years until some security researcher not affiliated with any of them found the bug by chance and made a public report, and by then it had already been explited by NSO for ages. If they had worked for Google (or Apple/Microsoft/Amazon/any of the other corporations that just imported Google’s libWebp code without looking at it) they would have gotten silenced and the exploit would still be there as a gift to Israel. Turns out just because it’s auditable doesn’t mean it gets audited before it’s too late.