7 ms·

This is such a naive view on computer security. It’s not just about spyware, which is also not exclusive to commercial vendors.

by justsid 5mo ago

fsflover 5mo ago
What else is this about? Debian repositories still contain no malware and if you install software exclusively from them, you'll be safe.
- M95D 5mo ago
  Does it contain Firefox? How about Chrome? Quote from LittleSnitch: > Little Snitch for Linux is built for privacy, not security What's your definion of malware in this context?
  - fsflover 5mo ago
    It contains Firefox and Chromium. You are right that they may call home, but at least it's very limited and easily configurable. Could be too much for you but fine with me. Also Debian does change their config by default to minimize privacy issues: https://news.ycombinator.com/item?id=32582260 https://news.ycombinator.com/item?id=32582260
    - m132 5mo ago
      It's far from easy in the case of Firefox [0], and the last time I tried, some .mozilla.com domains would still get pinged. Chromium doesn't even have an official guide. The only options I found to be reliable are source-level patches, i.e. ungoogled-chromium and LibreWolf. Note that LibreWolf still leaves some of the stuff on for you to manually disable (dom.push.connection.enabled, extension updates). [0] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making...
      - grepfru_it 5mo ago
        In firefox, goto about:config and search for url. You're welcome.
      - efreak 5mo ago
        I agree that push connections should be disabled. Maybe it can prompt you the first time you try to subscribe to one as to whether you're like to turn them on; this would annoy me personally, but also not break features by default. The annoyance hardly matters as websites already put an in-page prompt up before using the API, iirc because of Apple restrictions. Enabling extension updates by default seems like a smart thing, though, as long as you can turn them off easily (there should really be a setting for this), and possibly a 6-month reminder to update them (similar to the refresh your profile reminder when you haven't used the browser in for a while). Extension updates happen, and many of the most widely used extensions (eg. ublock origin) really should be updated every time it's available. Better that than having the extensions go online to fetch and run arbitrary payloads because you know they will if disabling updates gets popular enough.
- m132 5mo ago
  Run OpenSnitch for a while and you'll quickly realize how much of your system does phone home. Off the top of my head: - GNOME Shell (extension updates without a way to disable this, weather), - GNOME Calculator (currency exchange rates), - NetworkManager (periodic hotspot portal checks in most configurations), - GDB (debuginfod enabled by default), - Firefox (extension updates, push notifications, feature flags, telemetry, ..., some parts cannot be disabled), - VSCodium (Open VSX callbacks even when installing extensions from disk with updates disabled, JSON schema auto-downloads, extensions making their own unsolicited requests, ...), - Electron (dictionary updates from Google servers, no way of disabling; includes any application running on top of upstream Electron, such as Signal, Discord, etc.), - GoldenDict (audio samples fetched from the Internet on word look-up, no way to disable) Of course, this is nothing compared to Windows [0] and macOS [1], but the malpractice of making Internet connections without asking, by default, has unfortunately been finding its way everywhere since modems stopped making audible sounds. Having read about PRISM and seen the leaked dashboards of Paragon Graphite (said to be used by ICE), and with LLMs bridging the gap between mass and targeted surveillance, I don't want any of this. [0] https://github.com/microsoft/calculator/blob/ffd0519676019a0475cd16db4423af0a9829a4ba/src/CalcViewModel/Common/TraceLogger.cpp https://github.com/microsoft/calculator/blob/ffd0519676019a0... [1] https://sneak.berlin/20201112/your-computer-isnt-yours/ https://sneak.berlin/20201112/your-computer-isnt-yours/
  - consp 5mo ago
    > GNOME Calculator (currency exchange rates), Which would crash (technically hang) if you blocked it. [0] [0] https://forums.debian.net/viewtopic.php?p=818264 https://forums.debian.net/viewtopic.php?p=818264
  - worthless-trash 5mo ago
    Are these malware ?
    - m132 5mo ago
      Per se? No, maybe with the exception of GNOME Shell which literally runs code from the Internet unsandboxed. Can the traffic they silently generate be used for malicious purposes? Absolutely.
- givinguflac 5mo ago
  Ads, trackers, general boost to privacy. Not every protection tool is just about malware.
- Asooka 5mo ago
  Yeah I will also be safe if I never turn on the PC, but some of us use computers to do actual work.
stavros 5mo ago
It's not, though. There simply wasn't enough malware to worry about. Why would I run a firewall when I was unlikely to ever encounter a malicious program?
- ShinTakuya 5mo ago
  I mean, supply chain attacks are a thing that could have happened even in the earlier days. Linux almost got backdoored in 2003. Also with the number of remote code execution exploits that have occurred in Web browsers over the years it's hard to know for sure if what you installed hasn't been hijacked unless you spent all your time on gnu.org
  - stavros 5mo ago
    Yes, but the probability of the average user getting pwned was so small that it wasn't worth the constant firewall babysitting.

This is such a naive view on computer security. It’s not just about spyware, which is also not exclusive to commercial vendors.

by justsid 5mo ago

This is such a naive view on computer security. It’s not just about spyware, which is also not exclusive to commercial vendors.

fsflover 5mo ago

What else is this about? Debian repositories still contain no malware and if you install software exclusively from them, you'll be safe.

M95D 5mo ago
Does it contain Firefox? How about Chrome? Quote from LittleSnitch: > Little Snitch for Linux is built for privacy, not security What's your definion of malware in this context?
- fsflover 5mo ago
  It contains Firefox and Chromium. You are right that they may call home, but at least it's very limited and easily configurable. Could be too much for you but fine with me. Also Debian does change their config by default to minimize privacy issues: https://news.ycombinator.com/item?id=32582260 https://news.ycombinator.com/item?id=32582260
  - m132 5mo ago
    It's far from easy in the case of Firefox [0], and the last time I tried, some .mozilla.com domains would still get pinged. Chromium doesn't even have an official guide. The only options I found to be reliable are source-level patches, i.e. ungoogled-chromium and LibreWolf. Note that LibreWolf still leaves some of the stuff on for you to manually disable (dom.push.connection.enabled, extension updates). [0] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making...
    - grepfru_it 5mo ago
      In firefox, goto about:config and search for url. You're welcome.
    - efreak 5mo ago
      I agree that push connections should be disabled. Maybe it can prompt you the first time you try to subscribe to one as to whether you're like to turn them on; this would annoy me personally, but also not break features by default. The annoyance hardly matters as websites already put an in-page prompt up before using the API, iirc because of Apple restrictions. Enabling extension updates by default seems like a smart thing, though, as long as you can turn them off easily (there should really be a setting for this), and possibly a 6-month reminder to update them (similar to the refresh your profile reminder when you haven't used the browser in for a while). Extension updates happen, and many of the most widely used extensions (eg. ublock origin) really should be updated every time it's available. Better that than having the extensions go online to fetch and run arbitrary payloads because you know they will if disabling updates gets popular enough.
m132 5mo ago
Run OpenSnitch for a while and you'll quickly realize how much of your system does phone home. Off the top of my head: - GNOME Shell (extension updates without a way to disable this, weather), - GNOME Calculator (currency exchange rates), - NetworkManager (periodic hotspot portal checks in most configurations), - GDB (debuginfod enabled by default), - Firefox (extension updates, push notifications, feature flags, telemetry, ..., some parts cannot be disabled), - VSCodium (Open VSX callbacks even when installing extensions from disk with updates disabled, JSON schema auto-downloads, extensions making their own unsolicited requests, ...), - Electron (dictionary updates from Google servers, no way of disabling; includes any application running on top of upstream Electron, such as Signal, Discord, etc.), - GoldenDict (audio samples fetched from the Internet on word look-up, no way to disable) Of course, this is nothing compared to Windows [0] and macOS [1], but the malpractice of making Internet connections without asking, by default, has unfortunately been finding its way everywhere since modems stopped making audible sounds. Having read about PRISM and seen the leaked dashboards of Paragon Graphite (said to be used by ICE), and with LLMs bridging the gap between mass and targeted surveillance, I don't want any of this. [0] https://github.com/microsoft/calculator/blob/ffd0519676019a0475cd16db4423af0a9829a4ba/src/CalcViewModel/Common/TraceLogger.cpp https://github.com/microsoft/calculator/blob/ffd0519676019a0... [1] https://sneak.berlin/20201112/your-computer-isnt-yours/ https://sneak.berlin/20201112/your-computer-isnt-yours/
- consp 5mo ago
  > GNOME Calculator (currency exchange rates), Which would crash (technically hang) if you blocked it. [0] [0] https://forums.debian.net/viewtopic.php?p=818264 https://forums.debian.net/viewtopic.php?p=818264
- worthless-trash 5mo ago
  Are these malware ?
  - m132 5mo ago
    Per se? No, maybe with the exception of GNOME Shell which literally runs code from the Internet unsandboxed. Can the traffic they silently generate be used for malicious purposes? Absolutely.
givinguflac 5mo ago
Ads, trackers, general boost to privacy. Not every protection tool is just about malware.
Asooka 5mo ago
Yeah I will also be safe if I never turn on the PC, but some of us use computers to do actual work.

stavros 5mo ago

It's not, though. There simply wasn't enough malware to worry about. Why would I run a firewall when I was unlikely to ever encounter a malicious program?

ShinTakuya 5mo ago
I mean, supply chain attacks are a thing that could have happened even in the earlier days. Linux almost got backdoored in 2003. Also with the number of remote code execution exploits that have occurred in Web browsers over the years it's hard to know for sure if what you installed hasn't been hijacked unless you spent all your time on gnu.org
- stavros 5mo ago
  Yes, but the probability of the average user getting pwned was so small that it wasn't worth the constant firewall babysitting.