8 ms·

The problem is most likely how do you know it's the ms source unmodified?

wheelerof4te 3y ago
You don't, unless you build it yourself. That's the key value of open-source projects. You don't have to release a binary, just source code and a build guide. It's also one of the reasons why I have such high respect for OS distributions like BSDs and Slackware. They give you a good base that you can build upon if you know what you're doing. The problem is, many PC users don't really know what they're doing.
- no_wizard 3y ago
  >many PC users I'd say most, even software engineers. Can't tell you how many times I've had to explain how environmental variables work to developers, and that's a pretty simple concept compared to many other things in an operating system.
  - Pxtl 3y ago
    Most people cut their teeth on Windows, where the system environment bars are just a basically a section of the registry.
vorticalbox 3y ago
Becuase the repo uses github actions to pull changes and build the binary https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-linux.yml https://github.com/VSCodium/vscodium/blob/master/.github/wor...
- danpalmer 3y ago
  Having had a quick look through this workflow it seems to miss most opportunities to ensure a safe build. - Downloads binaries for use in build with no hash/signing verification. - Doesn't pin shared actions. - Uses Yarn to install dependencies (which can involve downloading/executing arbitrary code from anywhere) - Doesn't sign the final binary. None of this is necessarily wrong, all would make maintenance harder in the long run, but it means this project is really about removing MS branding and some telemetry, and that there is a security trade-off to get those benefits.
  - benatkin 3y ago
    None of these are a big deal. > - Downloads binaries for use in build with no hash/signing verification. It downloads them using TLS. > - Doesn't pin shared actions. The shared actions are just @actions/checkout and @actions/setup-node. They're official. I wouldn't pin them - YAGNI. > - Uses Yarn to install dependencies (which can involve downloading/executing arbitrary code from anywhere) It downloads/executes code based on the carefully chosen dependencies > - Doesn't sign the final binary. That's platform dependent I think. For Mac OS X it does. Seems like FUD, which you might be able to recognize because you say "None of this is necessarily wrong". Especially the part about pinning first party GitHub Actions. There would be nothing wrong with that but it is much more useful to pin third party GitHub Actions, and IMHO suboptimal to pin first party actions.
    - danpalmer 3y ago
      Ah yes it does sign on macOS. I don't think it's quite FUD, but I do agree none of these are strictly necessary, all can be rationalised as unnecessary and for many users this project probably provides a perfectly reasonable security posture. However the fact that there's so little explicit acknowledgement of the security concerns, and that 2 minutes looking at the repo turned these things up, suggests that security is not a priority of the project. Again, not the wrong thing to do, but maybe not the trade-offs all users will want. Pinning actions is so low effort/high reward that even the low risk makes it worth it for a project like this in my opinion. Official actions are certainly much safer, but ultimately it's still just human review and PRs being merged. Downloading over TLS negates some impact of hash/signing verification, but it would be a nice extra layer. You're otherwise putting a lot of trust in the combination of DNS+CDN+Hosting. I've seen hijacked sites due to IPs being re-used on cloud providers for example. Unlikely, but again easy to do and high impact in the rare situation that is is taken advantage of. Yarn dependencies may be carefully chosen, I'm not familiar with the VSCode practices. I bet that official binaries however are not built like this – I'd bet that there are allowances for specific network connectivity and binary execution, and that everything else is locked down. To my knowledge GitHub Actions have open internet access. I wouldn't even say this is low risk either, the NPM ecosystem is so deeply nested that I'm sure malicious code could be snuck in somewhere. This is a lot harder to solve for this project, and certainly the most debatable aspect as to whether it's worth it or not.

You don't, unless you build it yourself. That's the key value of open-source projects. You don't have to release a binary, just source code and a build guide. It's also one of the reasons why I have such high respect for OS distributions like BSDs and Slackware. They give you a good base that you can build upon if you know what you're doing. The problem is, many PC users don't really know what they're doing.

no_wizard 3y ago
>many PC users I'd say most, even software engineers. Can't tell you how many times I've had to explain how environmental variables work to developers, and that's a pretty simple concept compared to many other things in an operating system.
- Pxtl 3y ago
  Most people cut their teeth on Windows, where the system environment bars are just a basically a section of the registry.

vorticalbox 3y ago

Becuase the repo uses github actions to pull changes and build the binary https://github.com/VSCodium/vscodium/blob/master/.github/workflows/stable-linux.yml https://github.com/VSCodium/vscodium/blob/master/.github/wor...

danpalmer 3y ago
Having had a quick look through this workflow it seems to miss most opportunities to ensure a safe build. - Downloads binaries for use in build with no hash/signing verification. - Doesn't pin shared actions. - Uses Yarn to install dependencies (which can involve downloading/executing arbitrary code from anywhere) - Doesn't sign the final binary. None of this is necessarily wrong, all would make maintenance harder in the long run, but it means this project is really about removing MS branding and some telemetry, and that there is a security trade-off to get those benefits.
- benatkin 3y ago
  None of these are a big deal. > - Downloads binaries for use in build with no hash/signing verification. It downloads them using TLS. > - Doesn't pin shared actions. The shared actions are just @actions/checkout and @actions/setup-node. They're official. I wouldn't pin them - YAGNI. > - Uses Yarn to install dependencies (which can involve downloading/executing arbitrary code from anywhere) It downloads/executes code based on the carefully chosen dependencies > - Doesn't sign the final binary. That's platform dependent I think. For Mac OS X it does. Seems like FUD, which you might be able to recognize because you say "None of this is necessarily wrong". Especially the part about pinning first party GitHub Actions. There would be nothing wrong with that but it is much more useful to pin third party GitHub Actions, and IMHO suboptimal to pin first party actions.
  - danpalmer 3y ago
    Ah yes it does sign on macOS. I don't think it's quite FUD, but I do agree none of these are strictly necessary, all can be rationalised as unnecessary and for many users this project probably provides a perfectly reasonable security posture. However the fact that there's so little explicit acknowledgement of the security concerns, and that 2 minutes looking at the repo turned these things up, suggests that security is not a priority of the project. Again, not the wrong thing to do, but maybe not the trade-offs all users will want. Pinning actions is so low effort/high reward that even the low risk makes it worth it for a project like this in my opinion. Official actions are certainly much safer, but ultimately it's still just human review and PRs being merged. Downloading over TLS negates some impact of hash/signing verification, but it would be a nice extra layer. You're otherwise putting a lot of trust in the combination of DNS+CDN+Hosting. I've seen hijacked sites due to IPs being re-used on cloud providers for example. Unlikely, but again easy to do and high impact in the rare situation that is is taken advantage of. Yarn dependencies may be carefully chosen, I'm not familiar with the VSCode practices. I bet that official binaries however are not built like this – I'd bet that there are allowances for specific network connectivity and binary execution, and that everything else is locked down. To my knowledge GitHub Actions have open internet access. I wouldn't even say this is low risk either, the NPM ecosystem is so deeply nested that I'm sure malicious code could be snuck in somewhere. This is a lot harder to solve for this project, and certainly the most debatable aspect as to whether it's worth it or not.