Hacker News Reader

Comment by Crinus | Hacker News Reader

Note that this requires for a user to actually download and run this malware, it doesn't randomly get into someone's computer by itself:

> This implant is delivered in the form of a self-extracting archive shell script created with makeself

View on HN

Most malware is. The question becomes how good they are at tricking people to install it.

I'd expect very little success, most people on Linux download software from repositories or other trustworthy places (e.g. Steam).

Though some people do tend to install stuff via "curl | sudo bash"... but i think this malware is the least of their concerns :-P

With npm, pip and random github repositories used for plugins in various applications I tend to disagree. It's not like it is uncommon with third-party additions to package managers such as apt either.

I do not consider all 3rd party places as untrusted (this sort of thinking leads to walled gardens) and i'd put these under "downloading from trustworthy places" in the sense that they are more of a way to download something and less a source themselves (e.g. you can download a pip package from both a trustworthy developer and untrusted developer). Of course the more layers between you and whatever you want to download, the harder it becomes to judge things.

For example i'd trust an apt repository or pip package developed by -say- Blender developers, regardless of it being a 3rd party repository or delivered through pip.

Neither do I. But even if I download a pip package from blender and it depends on 14-third party packages - how on earth am I able to assess the risk/trust of that?

I most certainly trust that there is no ill intent from them and that it didn't raise any flags during testing. But even if I believe they have the resources to audit everything I might be getting a newer and infected version.

And even if my trust of a programmer/entity is rock-solid it is hard to guard against their account being compromised, that is all it takes for most 3rd party sources.

You can't really, but at some point you have to trust someone, otherwise everyone would recreate everything from scratch. Though TBH what i had in mind wasn't really the "let's download live code from random places" repositories like npm and pip, but more "static" repositories where all dependencies are either part of the repository itself or assumed to be already on your system.

And my point was that linux users depend on such repositories all the time.

There will probably be quite a few wake up-calls where this is exploited.

This is something I have wondered myself.

Would love if someone would chime in on the reality here.

Reply on news.ycombinator.com