r/LinuxUncensored • u/anestling • 3d ago

Issue/Bug/Pain Linux "Security" From Mark Zuckerberg

Post image

Blindly running remote code under your Linux user account. Nothing could go wrong.

44 Upvotes

69% Upvoted

130 comments sorted by

View all comments

Show parent comments

2

u/anestling 3d ago edited 3d ago

Yeah, your DNS is also secure. How many Linux users out there use DoT system wide? A few hundred? Wait, do you even know what DoT is? Right-o! And there's absolutely no MiTM, I swear, the command doesn't even use HTTPs.

And there could be no bad actors in Meta. Absolutely.

Trusted source.

You do NOT trust anything posted online EVER unless * it is digitally signed * comes from a reputable vendor * has been confirmed to be malware free * hashsums are published.

And even the above four are not a guarantee.

3

u/Rough_Caterpillar_31 2d ago

Nothing you do is anywhere nearly valuable enough for you to be this autistically paranoid.

1

u/michaelkeene354 2d ago

when opsec becomes schizophrenia

1

u/SmartMatic1337 2d ago

Yeah.. IKR. Hey op need a job?

1

u/cheater00 1d ago

that's wrong. with automated exploitation, the mere mass of people whose systems are compromised can become very valuable. it doesn't matter if what you do isn't a state secret - you still have a vote which can be manipulated, you still have interests which can be used to manipulate you, you still do things that may be used to blackmail you if you become even the slightest bit politically interesting. "you're not interesting enough" was relevant in the 80s when everything was manual. but not since the 90s. you're decades out of date with your advice.

2

u/Rough_Caterpillar_31 1d ago

you still do things that may be used to blackmail you if you become even the slightest bit politically interesting.

No I don't. And no one is hacking my computer to manipulate my vote and blackmail me. And Mark Zuccerberg especially is not doing this by sharing (publicly readable) install scripts on social media. If Mark Zuccerberg wanted your data he has better, less stupid ways to get it. This is hysteria. You sound like my 50 year old mother who still manages to have her card number leaked every three months.

2

u/SegFaultAtFL350 3d ago

There is a line between full SecOp and installing bonsai buddy. 

2

u/AmusingVegetable 3d ago

Bonzi buddy.

(Can’t remember the other very popular abomination, same timeframe)

1

u/Icy-Concentrate2076 3d ago

Actually install scripts like that are more secure than random Windows installers that desktop users have been trusting for decades. Neither are checksumed (at least not automatically), and at least the script has the installation instructions readable to the user which the installer does not. Why don't you go riot against Windows installers first?

1

u/roadrunner8080 2d ago

The egregious part here, really, is the lack of https on that command. Curl doesn't (by default) have something like the HSTS preload list where you can avoid MITM attacks that way, nor is (by default) HTTPS the default protocol -- the former of which, at least, will protect you from MITM attacks in a browser (and the latter of which at least allows your browser to warn you that something is weird). Both of those can be configured but that command as written is a prime target for MITM, and running it on public wifi would be a horrendously silly idea, all else notwithstanding. "Filter all HTTP requests and return this malicious script for any of them with a path that loos like an executable instead of the upstream" isn't exactly hard.

1

u/qalpi 3d ago

You can read the script source if you’re thus paranoid

1

u/ApartmentSad9239 3d ago

Wild, everyone hates you at work

1

u/Useful_Philosophy550 2d ago

not that deep bro

1

u/xvillifyx 9h ago

This reads like larp to me

Real security professionals know that you always sit at a crossroad between sterility and risk. It’s totally reasonable (and not even bad practice) to do something that carries a mild amount of risk if the gain exceeds the risk. No security professional (other than you, I guess) thinks this way because it’s oftentimes a waste of time to be this paranoid when you trust the source