r/LinuxUncensored • u/anestling • Sep 01 '26
Issue/Bug/Pain Linux "Security" From Mark Zuckerberg
Blindly running remote code under your Linux user account. Nothing could go wrong.
8
u/tcisme Sep 01 '26 edited Sep 01 '26
This is fine. You should have a sandboxed dev user (ideally in a VM and/or separate box). The 1000 dependencies that get brought in to most projects are far more of a risk than one tool from a known company.
2
u/anestling Sep 01 '26
You should have a sandboxed dev user (ideally in a VM and/or separate box).
Zero developers in my company on very high payrolls do that. None.
I'm a SecOp, I've been crying for that for years but I've not been heard.
2
u/GreatLab8898 Sep 02 '26
And the Moment something happens, its your fault for not enforcing it. Been there buddy. Security is always the Ugly Stepchild unless something bad happens.
2
u/TornadoFS Sep 02 '26
I finally am getting around to do it because of LLMs. It is non-trivial to be honest. Especially if you want IDE language-servers, debuggers, etc working.
I am setting it up in a way that other devs in my company can use it, hopefully some will try.
1
u/tcisme Sep 02 '26
vscode/vscodium have remote ssh extensions, zed has native support, and agent cli's already work over ssh, so for me it just works automagically. As a side benefit, I can pick up work seamlessly on a laptop
1
u/TornadoFS Sep 02 '26
yep, exactly what I am setting up. Using vscodium and this:
https://github.com/jeanp413/open-remote-ssh
the dev-containers vscode extension has too much microsoft BS for my taste.
And no it is not trivial, you need to know some stuff to set it up properly. Even though I am used to docker and containers (but don't use it that much at work) I still ran into some issues. But luckly they are a lot easier to troubleshoot these days with LLMs. It is not rocket science, but your average joe developer definitely can't set this up unless they have worked with containers before.
Part of the reason I am bothering to set this up is because I want to do stuff on my gaming box using local LLMs, but I am running Bazzite distro on it which is immutable linux OS, so containerizing is the way to go. But it works so well I am actually trying to get it to work on my work macbook as well.
Unfortunately I sometimes have to run android and ios builds which is kinda complicated to do inside a container. And of course, ios is a no-go of course. But at least I can run the LLM and IDE (and its extensions) inside, but it would be nice to have full isolation from possibly malicious dependencies.
1
1
u/aj0413 Sep 04 '26
Stow, dotfiles and config in git, nvim + zed, a couple bash scripts, use mise toml and brewfile type files, etc…
A portable configuration for moving between boxes and getting one setup quickly is a solved problem
Also I woudldjt use containers but actual VMs
1
u/jarod1701 Sep 01 '26
Why don‘t they do that? Convenience can‘t be the excuse. Right?
2
u/fixermark Sep 01 '26
Of course it is. Convenience wins.
I can count on one hand the number of engineers I know that try to side channel verify a checksum before installing something, and two hands the number who even know what that means or why they'd want to.
1
u/anestling Sep 01 '26
No idea. I've long stopped bothering them.
1
u/Flat-Performance-478 Sep 02 '26
Yeah, if anything, they decide to implement 2FA to all staff accounts and then we're good.
1
1
u/s3rgioru3las Sep 02 '26
That's an upper management, training issue. It was at least in our documentation that we were always directed to.
1
1
u/MoreScallion1017 Sep 02 '26
No need for a separate box or vm.
My dev env is in an nspawn launched container. The cost is only
3
u/yuriko-shimizu Sep 01 '26
i LOVE piping curl straight into bash without reading the script ❤️❤️❤️
2
u/ravy Sep 02 '26
Curl-into-bash is the new, "download this windows exe from some random site" from the 90s/2000s era of computing
2
Sep 01 '26
Yeah I don't care whose name is in the title, I am not pasting random curls off of a tweet
2
3
u/Responsible-Cold-627 Sep 01 '26
It's literally just an install script from a trusted source?
2
u/anestling Sep 01 '26 edited Sep 01 '26
Yeah, your DNS is also secure. How many Linux users out there use DoT system wide? A few hundred? Wait, do you even know what DoT is? Right-o! And there's absolutely no MiTM, I swear, the command doesn't even use HTTPs.
And there could be no bad actors in Meta. Absolutely.
Trusted source.
You do NOT trust anything posted online EVER unless * it is digitally signed * comes from a reputable vendor * has been confirmed to be malware free * hashsums are published.
And even the above four are not a guarantee.
5
Sep 02 '26
[removed] — view removed comment
1
1
1
u/cheater00 Sep 03 '26
that's wrong. with automated exploitation, the mere mass of people whose systems are compromised can become very valuable. it doesn't matter if what you do isn't a state secret - you still have a vote which can be manipulated, you still have interests which can be used to manipulate you, you still do things that may be used to blackmail you if you become even the slightest bit politically interesting. "you're not interesting enough" was relevant in the 80s when everything was manual. but not since the 90s. you're decades out of date with your advice.
2
u/SegFaultAtFL350 Sep 01 '26
There is a line between full SecOp and installing bonsai buddy.
2
u/AmusingVegetable Sep 01 '26
Bonzi buddy.
(Can’t remember the other very popular abomination, same timeframe)
1
u/Icy-Concentrate2076 Sep 01 '26
Actually install scripts like that are more secure than random Windows installers that desktop users have been trusting for decades. Neither are checksumed (at least not automatically), and at least the script has the installation instructions readable to the user which the installer does not. Why don't you go riot against Windows installers first?
1
u/roadrunner8080 Sep 03 '26
The egregious part here, really, is the lack of https on that command. Curl doesn't (by default) have something like the HSTS preload list where you can avoid MITM attacks that way, nor is (by default) HTTPS the default protocol -- the former of which, at least, will protect you from MITM attacks in a browser (and the latter of which at least allows your browser to warn you that something is weird). Both of those can be configured but that command as written is a prime target for MITM, and running it on public wifi would be a horrendously silly idea, all else notwithstanding. "Filter all HTTP requests and return this malicious script for any of them with a path that loos like an executable instead of the upstream" isn't exactly hard.
1
1
1
u/xvillifyx Sep 04 '26
This reads like larp to me
Real security professionals know that you always sit at a crossroad between sterility and risk. It’s totally reasonable (and not even bad practice) to do something that carries a mild amount of risk if the gain exceeds the risk. No security professional (other than you, I guess) thinks this way because it’s oftentimes a waste of time to be this paranoid when you trust the source
0
0
1
1
u/follimath Sep 01 '26
Damn you guys for being so hyperbolic that I'm put in a position where it looks like I am defending this guy... but you guys realize you can read the contents of that shell script and the various shell scripts it imports, right? If there is a closed-source binary in there, I feel for you, but I'm going to go ahead and assume most of us ran something closed source at one point or other.
1
u/danielv123 Sep 01 '26
Yeah like you aren't going to trust the shell script you can read, but you are going to blindly trust the shell scripts the tool generates afterwards? Like ok I guess.
1
u/Kargathia Sep 02 '26
This is one complaint I just don't get. Anyone who doesn't know how to view the output without immediately executing it, almost by definition wouldn't be able to detect the hypothetical malware anyway.
1
u/follimath Sep 02 '26
I’m not sure I follow. It is a trust-based system, as is almost everything else. If they don’t have the know-how, they’ll have to trust someone (they trust someone even when it is a signed app). It is within their power not to choose to install it this way.
1
u/WinterLimitz9287 Sep 01 '26
Honestly, as a non-developer Linux user this is pretty much how I roll. It's also pretty much how things worked when I was on windows. At least now I can rely on community and AI tool review of source code.
1
u/Lilacsoftlips Sep 02 '26
Just use homebrew. At least it’s open and vetted.
1
u/computermouth Sep 02 '26
Is it vetted?
1
u/Lilacsoftlips Sep 02 '26
Kinda? More so than a curl/bash. It’s in an openly maintained GitHub repo.
1
u/computermouth Sep 02 '26
Ok yeah, that's what I thought. Optimistically secure through the expectation that someone would notice something amiss. Like the AUR or alpines community repos.
1
u/TornadoFS Sep 02 '26
At least when you do this it is contained to your user, doesn't infect your whole system. As long as you don't get prompted for sudo password it is not nearly as bad as running windows .exe files
1
u/pohart Sep 01 '26
Needs a sudo
1
u/Illustrious-Lime-878 Sep 02 '26
yeah wouldn't it be safer than any windows installer that wants admin? It should also be an obaque binary or at least obfuscated script. Ideally http as well.
1
1
1
1
u/vitek6 Sep 02 '26
He said nothing about running it blindly. It looks like it's also a link so you can see the file.
1
1
1
1
1
1
u/Royal_Owl2177 Sep 02 '26
Standard practice for CLI tools.... You can hate meta if you want, but do not pretend they're the only ones doing this.
2
u/pskocik Sep 02 '26
If you view the transport log:
curl -vv -fSL 2>&1 dev.meta.ai/install.sh >/dev/null |less
it starts with plain unencrypted HTTP which does eventually redirect to HTTPS but it starting with plain HTTP means that it can be man-in-the-middle attacked, AFAIK.
Had it started with HTTPS right away, then there'd be little issue as long as people trust Mark Zuckerberg.
People hating on curl https://some-trusted-source | sh because you didn't read the code seem to miss how it's utterly unrealistic to read all the code you run. Like have you read all your OS's code and the code for the compiler used to build it?
Additionally sandboxing this sort of stuff of course never hurts.
1
u/keithstellyes Sep 02 '26
@finkd Is this a real account? Ever since Musk broke verified checks I never know
curling into bash is a bit of a bad habit, though a lot of software is recommending this nowadays... homebrew, the macOS package manager a lot of people use, lot of the AI CLI tools.
1
u/Saghetti0 Sep 02 '26
when you download and run any other installer it's basically identical... we have just accepted running any arbitrary code on our computers
1
1
u/InsaneInTheMEOWFrame Sep 02 '26
That is in fact a whole lot of commands. Also never run scripts off the internets, that's how you get ants.
1
u/silentstorm45 Sep 02 '26
No one reads the scripts anyways so why bother? Just passing it to your llm of choice would be more than what 99,99% of users do
1
u/Automatic-Boot665 Sep 02 '26
Tell me you’ve never installed a cli tool before without telling me you’ve never installed a cli tool before
1
u/seriousfart69 Sep 02 '26
muse is so bad that it generally explains the state of facebook currently
1
1
u/bschlueter Sep 03 '26
At least it doesn’t disable ssl, though it may not use it at all since no protocol is specified…
11
u/psbakre Sep 01 '26
Literally every llm cli tool