5 ms·

Yep, but pretty much every single piece of software you've installed on your system can read and write files to your home directory in a silent way without root

by nickjj 17d ago

Yep, but pretty much every single piece of software you've installed on your system can read and write files to your home directory in a silent way without root, and that's where your most important files are on a desktop machine (API tokens, secrets, client projects, etc.). I have my own opinionated Arch / niri set up and there's 1155 packages installed. That's 1155 opportunities for a package to be compromised. This is also why I try very hard to avoid the AUR and only use it as a last resort (I use 2 packages from it). It doesn't guarantee safety but the official Arch package repos do seem to have more checks and bounds vs the AUR.

lrvick 17d ago
Arch at least mandates author signed packages which is unfortunately rare these days, but keys do not need to be on smartcards, and code review is not enforced. You compromise the right arch maintainer and you could do some real damage. Arch is second only to Guix in terms of supply chain security for desktop distributions, but both still have a threat model that cannot tolerate a single laptop compromise. Stay tuned for stagex for workstations. https://stagex.tools https://stagex.tools
- NekkoDroid 16d ago
  I do know some of the arch maintainers (e.g. dvzrv IIRC) are working on build infrastructure that would completely automate the build process and HSM signing to separate read-only images on build servers[0, 1, 2]. I haven't heard about updates to buildbtw in a while, but development seems still somewhat active and signstar is mentioned now and then at some conferences. It feels like it is not making any progress, but I don't pay any attention to the development, so it is likely just my perception of it just having been waiting on visible process to it and not seeing it. [0]: https://gitlab.archlinux.org/archlinux/signstar https://gitlab.archlinux.org/archlinux/signstar [1]: https://gitlab.archlinux.org/archlinux/signstar-os https://gitlab.archlinux.org/archlinux/signstar-os [2]: https://gitlab.archlinux.org/archlinux/buildbtw https://gitlab.archlinux.org/archlinux/buildbtw
  - lrvick 16d ago
    I am aware of their work, and while this is better than the status quo, it does even come close to my threat model of "trust no single computer or machine" which is what I must support.

by nickjj 17d ago

lrvick 17d ago

Arch at least mandates author signed packages which is unfortunately rare these days, but keys do not need to be on smartcards, and code review is not enforced. You compromise the right arch maintainer and you could do some real damage. Arch is second only to Guix in terms of supply chain security for desktop distributions, but both still have a threat model that cannot tolerate a single laptop compromise. Stay tuned for stagex for workstations. https://stagex.tools https://stagex.tools

NekkoDroid 16d ago
I do know some of the arch maintainers (e.g. dvzrv IIRC) are working on build infrastructure that would completely automate the build process and HSM signing to separate read-only images on build servers[0, 1, 2]. I haven't heard about updates to buildbtw in a while, but development seems still somewhat active and signstar is mentioned now and then at some conferences. It feels like it is not making any progress, but I don't pay any attention to the development, so it is likely just my perception of it just having been waiting on visible process to it and not seeing it. [0]: https://gitlab.archlinux.org/archlinux/signstar https://gitlab.archlinux.org/archlinux/signstar [1]: https://gitlab.archlinux.org/archlinux/signstar-os https://gitlab.archlinux.org/archlinux/signstar-os [2]: https://gitlab.archlinux.org/archlinux/buildbtw https://gitlab.archlinux.org/archlinux/buildbtw
- lrvick 16d ago
  I am aware of their work, and while this is better than the status quo, it does even come close to my threat model of "trust no single computer or machine" which is what I must support.