vanderbilt @ vanderbilt @lemmy.world

Sometimes I call the numbers on missing dog posters and just bark into the

---

Read more

Posts

1

Comments

96

Joined

1 yr. ago

Haha Mint was my first distro! I wiped Windows 7 and installed Mint, then quickly learned that a tarball is in fact more work than an exe. Good times and a great learning experience! Back then it was the only thing not slow, ugly, or wildly unfamiliar.

True that. There have been so many wins in just a few years.

I admire your gusto! I think it's doable, and you can definitely pull it off if you want to. To replace MD5 and implement signatures you need to do the following, as a high level overview:

Extend dpkg to know what SHA2 is, and reliably detect it. (maybe measure hash length or specifying a new version using the control file?)

dpkg must also know what a signature is. More on that below.

Providing automatic/mandatory signing will require code to handle PKI as well as a place to store the signing information. I would do it by signing the two archives found within Deb packages, then placing information about the signing in the top-level of the package. Existing tools need to be able to ignore or handle whatever you implement as a rule of thumb.

Note that this is just my approach and maybe you can do better.

I also recommended looking into https://lists.debian.org/debian-dpkg/2001/03/msg00024.html. This is the thread I mentioned earlier, in which package signatures were discussed and ultimately turned down. Maybe the easiest approach is to re-implement what the contributor was trying to do back then, but with modern code and standards? If you want more resources, including my presentation on the topic to HackCFL and CitrusSec, let me know. I am here for whatever technical assistance or industry contacts I can provide. The white paper might be done in a month, minus peer review. I'm very busy and so is he. Good luck in any case!

To save you some effort, they do not consider it a priority to fix. Code was attempted to merge that would make package signatures the default, but it was removed because it “was a waste of cpu cycles” when “md5 and the https was just as good”. I’m not kidding, you can find the whole conversation in the Debian mailing archives. So instead I’m going to make it known how dumb it is, and encourage people to use something else.

In theory (whitepaper is still being written), if you MITM the connection to the APT mirror it's using you can also carry out the attack over the network by injecting it into the package on the fly. Cert pinning might be a blocker, but local (LAN) package mirrors might still be valid attack targets. Enterprises often use MITM certs for things like DLP and packet inspection we might be able to leverage at least.

The use of MD5 becomes a bigger issue when paired with the lack of package signatures. You can inject code into a package and find a colliding digest absurdly fast. I and a friend from Threatlocker created a Metasploit module to use Deb packages for local privesc based on the concept. If it touches the filesystem outside of the APT cache it becomes a vector.

Did they ever make good on this plan?

RPM must accept SHA-1 hashes and DSA keys for Fedora 38, ideally with a deprecation warning that it will be disabled in F39.

And MD5 for package integrity checking, and not using per-package PKI signatures.

Can you recommend any IRC channels for techies please? I like infosec, Linux, and Mac topics but I can't find any communities that aren't turbo-clicky or dead. Most channels I've found are like ham radio: a bunch of old grumpy people ragchewing. I'd like an actual conversation I can contribute to.

日本にもう子供はいません。

It`s not as bad as Korea, but this is no surprise. Things will get worse as the population of elderly people grows. Housing isn't expensive like in the west, so that's not the cause, but rather jobs are hard work and the yen is becoming less valuable. I have some hope in the さとり generation to break the toxic work cycle, but that won't solve the affordability issues.

They chose an interesting time to switch licensing. MS introduced Garnet, and now the LF has Valkey as a direct descendent. Strange times ahead.

I'm amazed they were able to achieve anything with him at the helm

It's shocking how bad the competition is in the laptop space. There are good options, but none of them have the great battery life, great screen, performance, and good trackpad all in one device. The margins being so low probably don't help the situation. Developing for Windows native is meh edging on bad, so most apps these days are written in Electron or Qt and available on whatever other platform you use. The ship won't sink because of Windows, it'll sink because people aren't buying the hardware that has Windows.

Allegedly they have their own thing in the works, a la an Xbox in the handheld form factor. Don't see what they are hoping to achieve with it though. The root problem is a lack of compelling games. Only way I see it going well is if they pull a Surface move and put all the other OEMs to shame with a good end-user experience.

Bonsi-buddy gang rise up.

I blame MS because they have repeatedly failed to light a big enough fire under app devs to get them to migrate to modern APIs and write more arch agnostic code, nor have they provided the tooling to get it done. Why isn't the default on every MS compiler for Windows to produce fat binaries for x86 and ARM? That alone would help adoption greatly.