As someone who is cyber security conscious, I immediately spot the curl-ed script piped to shell, seems to be happening more and more past years in various projects, I am unsure if I like this...
As someone who is cyber security conscious, I immediately spot the curl-ed script piped to shell, seems to be happening more and more past years in various projects, I am unsure if I like this future :/
I’m ambivalent about this trend because I fully agree with you and it makes me twitchy, but I also don’t know if I’d actually expect a pre/post-install script pulled in by a package manager to be...
I’m ambivalent about this trend because I fully agree with you and it makes me twitchy, but I also don’t know if I’d actually expect a pre/post-install script pulled in by a package manager to be properly vetted on every incremental version bump either.
Idk, maybe I’m missing a key detail but it feels like it’s emphasising a risk that was previously hidden (and, yes, previously a bit better controlled in theory but perhaps not in practice?) rather than creating a particularly large new risk?
Speaking from experience from being a package maintainer for a Linux distro (I am now retired from that)... Yeah you are right in regards of publicly maintained package registries, as in pypi and...
Speaking from experience from being a package maintainer for a Linux distro (I am now retired from that)... Yeah you are right in regards of publicly maintained package registries, as in pypi and npm package registries, but its a whole different story when package is inside a linux distro package registry. Linux distro package registry follows more strict guidelines and flows, and even then many things go through the process, but its still way better in terms of security than running a random shell script from the internet.
It makes me think that the developers assume you’re going to sandbox their app in a Docker container, which I’d do if I had the time and patience to sit down and learn Docker… I guess maybe I...
It makes me think that the developers assume you’re going to sandbox their app in a Docker container, which I’d do if I had the time and patience to sit down and learn Docker… I guess maybe I should, finally.
Docker is horrible for security. Infamously the docker daemon runs right on root, which means that it just sidesteps the entirety of Linux's security systems. Docker introduces its own ways to...
Docker is horrible for security. Infamously the docker daemon runs right on root, which means that it just sidesteps the entirety of Linux's security systems. Docker introduces its own ways to maintain process isolation, but you're really just trading one problem for another. Your average systemd script running on bare metal has MUCH better security isolation than your average docker container (which is most likely given free reign in the docker-compose config and running on a process with root access).
What docker makes easy is dependencies. When you run docker containers, you can be sure that everything will run, and you won't explode because some random system library on your system is a different version than what the application expects.
Docker done right could be kinda ok, if you know what you are doing, many dont spend enough time with it to know how. You do not need to run dockerd as root, although that is the default, but you...
Docker done right could be kinda ok, if you know what you are doing, many dont spend enough time with it to know how. You do not need to run dockerd as root, although that is the default, but you will have then some network and mounting considerations that could be an issue in some environments. Docker stopped using linux namespaces a long time ago, they went their own way (peronally I do not like that), bigger issue is that they have huge security holes, and they do not want to fix them because if they do they will break compatibility with already existing flows. For example, as a regular user on a host that has access to dockerd, mounting host root to the docker container and then running as root inside you can do anything to the host. Systemd is a bit better but not ideal as well, it's using linux namespaces and Linux kernel had about 800 critical CVEs counting till previous month or so. There is also podman which uses linux namespaces as well.
On the other side there are virtual machines, which are way better in terms of security, if you happen to find a vulnerability that escapes from qemu/kvm (one discovered recently) you can get up to $1M, paid by Google, if I remember correctly. For better security options and lower resource usage you can take a look at micro VMs.
Although containerization is way more vulnerable than running in a VM, this is still much better approach than running random software directly on host.
Although containerization is way more vulnerable than running in a VM, this is still much better approach than running random software directly on host.
See that’s the kind of stuff I need to learn. I’m familiar with spinning up full VMs like in Virtual Box, installing a full operating system and running apps and scripts within that image, but...
See that’s the kind of stuff I need to learn. I’m familiar with spinning up full VMs like in Virtual Box, installing a full operating system and running apps and scripts within that image, but Docker seems like the same concept but… not?
I wouldn't recommend using Docker to sandbox it... It's better than going raw, but the point of docker containers is putting your dependencies together, it makes no effort to be a secure sandbox
I wouldn't recommend using Docker to sandbox it... It's better than going raw, but the point of docker containers is putting your dependencies together, it makes no effort to be a secure sandbox
Honestly it seems like Docker's not that useful for me and what I do. Thanks for saving me a long time trying to learn a tech I'm never going to implement.
Honestly it seems like Docker's not that useful for me and what I do. Thanks for saving me a long time trying to learn a tech I'm never going to implement.
Hey! A while ago I found this cool site/service that lives in the terminal and has a bunch of fun stuff from chatting to playing daily games, an artboard, and streaming. Its quite fun, and i...
Hey!
A while ago I found this cool site/service that lives in the terminal and has a bunch of fun stuff from chatting to playing daily games, an artboard, and streaming. Its quite fun, and i thought some people from tildes might like it too! Everything lives in the terminal and can be accessed via ssh, however there is a terminal application that adds some additional features like music listening!
PS If you do join, use my invite code!! We can both get some chips to buy drinks and play games lol
ssh invite-hsk8xsbt@late.sh
I used your code because I was curious. Man the amount of work that went into building this is insane!!! Edit: unless it’s AI. Because the project is 6 months old, it’s easier a lot of time spent...
I used your code because I was curious. Man the amount of work that went into building this is insane!!!
Edit: unless it’s AI. Because the project is 6 months old, it’s easier a lot of time spent coding or a lot of tokens. Either way, there is a lot going on. Thanks for sharing
This is very interesting. As someone that already spends too much time on irc this is probably up my alley. If I end up joining I'll use your invite code.
This is very interesting. As someone that already spends too much time on irc this is probably up my alley. If I end up joining I'll use your invite code.
I do idle in there, I'm literally there now :) As you said it's quite dead most of the time, but I'm there and if it become more lively I'm sure I'll end up chatting.
I do idle in there, I'm literally there now :) As you said it's quite dead most of the time, but I'm there and if it become more lively I'm sure I'll end up chatting.
This site seems cool, and I don't mind the vibe coded back end, but all of the ai generated text is exhausting especially with the paper seeming to be pretty ai generated. I don't know. Thanks for...
This site seems cool, and I don't mind the vibe coded back end, but all of the ai generated text is exhausting especially with the paper seeming to be pretty ai generated. I don't know. Thanks for sharing!
As someone who is cyber security conscious, I immediately spot the curl-ed script piped to shell, seems to be happening more and more past years in various projects, I am unsure if I like this future :/
I’m ambivalent about this trend because I fully agree with you and it makes me twitchy, but I also don’t know if I’d actually expect a pre/post-install script pulled in by a package manager to be properly vetted on every incremental version bump either.
Idk, maybe I’m missing a key detail but it feels like it’s emphasising a risk that was previously hidden (and, yes, previously a bit better controlled in theory but perhaps not in practice?) rather than creating a particularly large new risk?
Speaking from experience from being a package maintainer for a Linux distro (I am now retired from that)... Yeah you are right in regards of publicly maintained package registries, as in pypi and npm package registries, but its a whole different story when package is inside a linux distro package registry. Linux distro package registry follows more strict guidelines and flows, and even then many things go through the process, but its still way better in terms of security than running a random shell script from the internet.
It makes me think that the developers assume you’re going to sandbox their app in a Docker container, which I’d do if I had the time and patience to sit down and learn Docker… I guess maybe I should, finally.
Docker is horrible for security. Infamously the docker daemon runs right on root, which means that it just sidesteps the entirety of Linux's security systems. Docker introduces its own ways to maintain process isolation, but you're really just trading one problem for another. Your average systemd script running on bare metal has MUCH better security isolation than your average docker container (which is most likely given free reign in the docker-compose config and running on a process with root access).
What docker makes easy is dependencies. When you run docker containers, you can be sure that everything will run, and you won't explode because some random system library on your system is a different version than what the application expects.
Docker done right could be kinda ok, if you know what you are doing, many dont spend enough time with it to know how. You do not need to run dockerd as root, although that is the default, but you will have then some network and mounting considerations that could be an issue in some environments. Docker stopped using linux namespaces a long time ago, they went their own way (peronally I do not like that), bigger issue is that they have huge security holes, and they do not want to fix them because if they do they will break compatibility with already existing flows. For example, as a regular user on a host that has access to dockerd, mounting host root to the docker container and then running as root inside you can do anything to the host. Systemd is a bit better but not ideal as well, it's using linux namespaces and Linux kernel had about 800 critical CVEs counting till previous month or so. There is also podman which uses linux namespaces as well.
On the other side there are virtual machines, which are way better in terms of security, if you happen to find a vulnerability that escapes from qemu/kvm (one discovered recently) you can get up to $1M, paid by Google, if I remember correctly. For better security options and lower resource usage you can take a look at micro VMs.
Hmm, I have profoundly misunderstood what Docker is for. It sounds almost like it's just Python's Venv but for other programs...
Although containerization is way more vulnerable than running in a VM, this is still much better approach than running random software directly on host.
See that’s the kind of stuff I need to learn. I’m familiar with spinning up full VMs like in Virtual Box, installing a full operating system and running apps and scripts within that image, but Docker seems like the same concept but… not?
(Edit: installinga -> installing a)
I wouldn't recommend using Docker to sandbox it... It's better than going raw, but the point of docker containers is putting your dependencies together, it makes no effort to be a secure sandbox
Honestly it seems like Docker's not that useful for me and what I do. Thanks for saving me a long time trying to learn a tech I'm never going to implement.
Hey!
A while ago I found this cool site/service that lives in the terminal and has a bunch of fun stuff from chatting to playing daily games, an artboard, and streaming. Its quite fun, and i thought some people from tildes might like it too! Everything lives in the terminal and can be accessed via ssh, however there is a terminal application that adds some additional features like music listening!
PS If you do join, use my invite code!! We can both get some chips to buy drinks and play games lol
ssh invite-hsk8xsbt@late.sh
I used your code because I was curious. Man the amount of work that went into building this is insane!!!
Edit: unless it’s AI. Because the project is 6 months old, it’s easier a lot of time spent coding or a lot of tokens. Either way, there is a lot going on. Thanks for sharing
Claude is the 5th-higest contributor to the repo.
Please tag as vibe coded, thank you!
Done. 👍
This is very interesting. As someone that already spends too much time on irc this is probably up my alley. If I end up joining I'll use your invite code.
come idle in #tildes on libera! it’s totally dead right now, but one day i’ll do a proper announcement and it’ll be super active for that day :)
I do idle in there, I'm literally there now :) As you said it's quite dead most of the time, but I'm there and if it become more lively I'm sure I'll end up chatting.
haha perfect. it took forever to get one of the staff to transfer it over to me.
i should make a post about it. i love irc.
This site seems cool, and I don't mind the vibe coded back end, but all of the ai generated text is exhausting especially with the paper seeming to be pretty ai generated. I don't know. Thanks for sharing!