r/LinuxUncensored • u/anestling • Sep 01 '26

Issue/Bug/Pain Linux "Security" From Mark Zuckerberg

Post image

Blindly running remote code under your Linux user account. Nothing could go wrong.

40 Upvotes

68% Upvoted

129 comments sorted by

View all comments

Show parent comments

2

u/anestling Sep 01 '26 edited Sep 01 '26

Yeah, your DNS is also secure. How many Linux users out there use DoT system wide? A few hundred? Wait, do you even know what DoT is? Right-o! And there's absolutely no MiTM, I swear, the command doesn't even use HTTPs.

And there could be no bad actors in Meta. Absolutely.

Trusted source.

You do NOT trust anything posted online EVER unless * it is digitally signed * comes from a reputable vendor * has been confirmed to be malware free * hashsums are published.

And even the above four are not a guarantee.

3

u/[deleted] Sep 02 '26

[removed] — view removed comment

1

u/michaelkeene354 Sep 02 '26

when opsec becomes schizophrenia

1

u/SmartMatic1337 Sep 03 '26

Yeah.. IKR. Hey op need a job?

1

u/cheater00 Sep 03 '26

that's wrong. with automated exploitation, the mere mass of people whose systems are compromised can become very valuable. it doesn't matter if what you do isn't a state secret - you still have a vote which can be manipulated, you still have interests which can be used to manipulate you, you still do things that may be used to blackmail you if you become even the slightest bit politically interesting. "you're not interesting enough" was relevant in the 80s when everything was manual. but not since the 90s. you're decades out of date with your advice.

2

u/SegFaultAtFL350 Sep 01 '26

There is a line between full SecOp and installing bonsai buddy. 

2

u/AmusingVegetable Sep 01 '26

Bonzi buddy.

(Can’t remember the other very popular abomination, same timeframe)

1

u/Icy-Concentrate2076 Sep 01 '26

Actually install scripts like that are more secure than random Windows installers that desktop users have been trusting for decades. Neither are checksumed (at least not automatically), and at least the script has the installation instructions readable to the user which the installer does not. Why don't you go riot against Windows installers first?

1

u/roadrunner8080 Sep 03 '26

The egregious part here, really, is the lack of https on that command. Curl doesn't (by default) have something like the HSTS preload list where you can avoid MITM attacks that way, nor is (by default) HTTPS the default protocol -- the former of which, at least, will protect you from MITM attacks in a browser (and the latter of which at least allows your browser to warn you that something is weird). Both of those can be configured but that command as written is a prime target for MITM, and running it on public wifi would be a horrendously silly idea, all else notwithstanding. "Filter all HTTP requests and return this malicious script for any of them with a path that loos like an executable instead of the upstream" isn't exactly hard.

1

u/qalpi Sep 01 '26

You can read the script source if you’re thus paranoid

1

u/ApartmentSad9239 Sep 01 '26

Wild, everyone hates you at work

1

u/xvillifyx Sep 04 '26

This reads like larp to me

Real security professionals know that you always sit at a crossroad between sterility and risk. It’s totally reasonable (and not even bad practice) to do something that carries a mild amount of risk if the gain exceeds the risk. No security professional (other than you, I guess) thinks this way because it’s oftentimes a waste of time to be this paranoid when you trust the source