5 ms·

I wonder how legit are some of the most popular download sites: e.g ffmpeg windows binaries [1] are hosted from some random person’s site. Sure you can check th

I wonder how legit are some of the most popular download sites: e.g ffmpeg windows binaries [1] are hosted from some random person’s site. Sure you can check the checksum etc but that still doesn’t guarantee any relationship with a specific git commit. I would just assume that non-gh or official hosted downloads (where reproducible/attested builds are available) are just state actors by default. Am I paranoid? How do Linux/Mac package managers solve this? [1] https://ffmpeg.org/download.html https://ffmpeg.org/download.html

callalex 3y ago
Reproducible Builds is the search term/buzzword for this area. It is still in its infancy.
account42 3y ago
I trust random developers more to host software that does not go against my interests than big tech corporations.
0xDEAFBEAD 3y ago
Why trust Github? The GetSymbol tool has 215 stars there. Looks perfectly legit unless you check the issues. https://github.com/dbgsymbol/getsymbol https://github.com/dbgsymbol/getsymbol
- diego_sandoval 3y ago
  You don't trust Github to not host any malware, and you don't trust Github to not have malicious users. You trust Github to have reasonably good security, and to not maliciously meddle with user content, so that if you see a repository under github.com/neovim, and you additionally trust the user called neovim, then you can reasonably trust that any repositories under github.com/neovim don't contain malware.
  - archargelod 3y ago
    Even when you trust the repo owner, you can't trust their projects. Bad actor could still sibmit a PR with malicious code and it could be merged just by negligence.
wheelerof4te 3y ago
"How do Linux/Mac package managers solve this?" By building their binaries from source and hosting them on their servers?
- dewey 3y ago
  Wouldn't help if the source code already has the backdoor in there though. Most people would just download and build a tool off GitHub if it has 200 stars and does what they need.
  - deleted 3y ago
    [deleted]
  - pixl97 3y ago
    Github stars are also complete bullshit that can be gamed itself.
  - wheelerof4te 3y ago
    It's extremely hard to sneak backdoors in open-source code. Which is one of the reasons why a lot of people promote that openness.
    - userbinator 3y ago
      It's extremely easy to sneak backdoors in open-source code that contains automatic update functionality.
    - dewey 3y ago
      Into a popular repository yes, but into a small tool like that it would most likely be very possible.
      - wheelerof4te 3y ago
        Small tool = less code to read through. If you want to use that suspicious tool, you should at least take a glance at the source code.
gsuuon 3y ago
If I don't see a github action I'll usually pass on downloading. But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source?
- Pathogen-David 3y ago
  > But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source? The concern is that FFmpeg does not provide Windows binaries for themselves, they link to someone else who does. You could argue that those providers are fine since they're implicitly being endorsed by FFmpeg, but it's not super clear whether they're trustworthy people involved in FFmpeg or randos that opened a GitHub issue saying "Hey I'm providing Windows binaries for people if they want them!"
  - thecatspaw 3y ago
    they also link to this repository: https://github.com/BtbN/FFmpeg-Builds https://github.com/BtbN/FFmpeg-Builds
  - gsuuon 3y ago
    Oh I see I didn't notice the additional links popping up on hover. Oof, that's not great.
facorreia 3y ago
Even binaries hosted on an official website can be hacked, if they hack the website and change the checksums. It happened to Linux Mint. https://www.trendmicro.com/vinfo/fr/security/news/cybercrime-and-digital-threats/linux-mint-website-hacked-iso-downloads-replaced-with-a-backdoor#:~:text=As%20stated%20in%20Linux%20Mint's,used%20to%20implement%20a%20backdoor https://www.trendmicro.com/vinfo/fr/security/news/cybercrime....
- makeworld 3y ago
  This is why signing binaries is important.
diego_sandoval 3y ago
> ffmpeg windows binaries [1] are hosted from some random person’s site The same thing happens with mpv: https://mpv.io/installation/ https://mpv.io/installation/ The Windows download is provided by "shinchiro" on SourceForge. The MacOS download is provided by "stolendata", on stolendata.net
- account42 3y ago
  Wait until you find out that useful programs like MPV are not developed by giant corporations but by individuals or small teams. Trust something hosted on mpv.io made by the MPV maintainer but freak out when that maintainer delegates release builds for some platforms to someone else he is comfortable linking to. MPV probably also uses many libraries developed by other individuals. A society build on trust is a GOOD thing.

callalex 3y ago

Reproducible Builds is the search term/buzzword for this area. It is still in its infancy.

account42 3y ago

I trust random developers more to host software that does not go against my interests than big tech corporations.

0xDEAFBEAD 3y ago

Why trust Github? The GetSymbol tool has 215 stars there. Looks perfectly legit unless you check the issues. https://github.com/dbgsymbol/getsymbol https://github.com/dbgsymbol/getsymbol

diego_sandoval 3y ago
You don't trust Github to not host any malware, and you don't trust Github to not have malicious users. You trust Github to have reasonably good security, and to not maliciously meddle with user content, so that if you see a repository under github.com/neovim, and you additionally trust the user called neovim, then you can reasonably trust that any repositories under github.com/neovim don't contain malware.
- archargelod 3y ago
  Even when you trust the repo owner, you can't trust their projects. Bad actor could still sibmit a PR with malicious code and it could be merged just by negligence.

wheelerof4te 3y ago

"How do Linux/Mac package managers solve this?" By building their binaries from source and hosting them on their servers?

dewey 3y ago
Wouldn't help if the source code already has the backdoor in there though. Most people would just download and build a tool off GitHub if it has 200 stars and does what they need.
- deleted 3y ago
  [deleted]
- pixl97 3y ago
  Github stars are also complete bullshit that can be gamed itself.
- wheelerof4te 3y ago
  It's extremely hard to sneak backdoors in open-source code. Which is one of the reasons why a lot of people promote that openness.
  - userbinator 3y ago
    It's extremely easy to sneak backdoors in open-source code that contains automatic update functionality.
  - dewey 3y ago
    Into a popular repository yes, but into a small tool like that it would most likely be very possible.
    - wheelerof4te 3y ago
      Small tool = less code to read through. If you want to use that suspicious tool, you should at least take a glance at the source code.

gsuuon 3y ago

If I don't see a github action I'll usually pass on downloading. But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source?

Pathogen-David 3y ago
> But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source? The concern is that FFmpeg does not provide Windows binaries for themselves, they link to someone else who does. You could argue that those providers are fine since they're implicitly being endorsed by FFmpeg, but it's not super clear whether they're trustworthy people involved in FFmpeg or randos that opened a GitHub issue saying "Hey I'm providing Windows binaries for people if they want them!"
- thecatspaw 3y ago
  they also link to this repository: https://github.com/BtbN/FFmpeg-Builds https://github.com/BtbN/FFmpeg-Builds
- gsuuon 3y ago
  Oh I see I didn't notice the additional links popping up on hover. Oof, that's not great.

facorreia 3y ago

Even binaries hosted on an official website can be hacked, if they hack the website and change the checksums. It happened to Linux Mint. https://www.trendmicro.com/vinfo/fr/security/news/cybercrime-and-digital-threats/linux-mint-website-hacked-iso-downloads-replaced-with-a-backdoor#:~:text=As%20stated%20in%20Linux%20Mint's,used%20to%20implement%20a%20backdoor https://www.trendmicro.com/vinfo/fr/security/news/cybercrime....

makeworld 3y ago
This is why signing binaries is important.

diego_sandoval 3y ago

> ffmpeg windows binaries [1] are hosted from some random person’s site The same thing happens with mpv: https://mpv.io/installation/ https://mpv.io/installation/ The Windows download is provided by "shinchiro" on SourceForge. The MacOS download is provided by "stolendata", on stolendata.net

account42 3y ago
Wait until you find out that useful programs like MPV are not developed by giant corporations but by individuals or small teams. Trust something hosted on mpv.io made by the MPV maintainer but freak out when that maintainer delegates release builds for some platforms to someone else he is comfortable linking to. MPV probably also uses many libraries developed by other individuals. A society build on trust is a GOOD thing.