this post was submitted on 26 Mar 2024
71 points (93.8% liked)
Linux
47332 readers
1176 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
On the one hand, if any commercial store put out a statement like this and did no vetting of submitted applications people would (rightly) be up in arms. But on the other, this is pretty much the standard with FOSS, right? Unless you’re paying for a supported commercial license from someone like Red Hat, everything is as-is, without warranty, caveat emptor. The power of open source is that anyone can review the code and look for problems or malicious behavior, but also (especially with smaller projects) there’s no guarantee that anyone else has looked at the code. So is it a best practice with Linux and FOSS to run a system backup before installing any software or update? I mean I guess that’s technically true for any OS, but especially for open source?
Users are probably aware of that with most software. But for something called a "theme", we're used to expecting it to be a bunch of non-executable resources. I'm sure I wasn't the only one who gave it no thought and made this assumption, since it applies almost everywhere else we see themes.
Yeah 100%.
They should be given a more threatening name.
Maybe the word "global" is supposed to invoke fear (maybe it does for people who review shonky c++ code a lot).
But I don't think that is so for most people.
Better to call them "High risk unofficial theme" or something to prompt people to read the small print.
In my mind, it's more like a library of scripts. Scripts are powerful and could potentially do anything, and it would be wise to not run these scripts arbitrarily without reviewing them first or having some other trust basis you can rely upon.
For example, I don't think you're expected to review all open source software on your system. It's much easier to instead trust a group of people with high visibility, such as the core Debian developers, and proceed to exercise graduated caution according to the likelihood that the code has been reviewed. You probably don't need to review the Linux kernel. When it comes to random widgets and themes off the internet, it's easy to encounter code that has never been reviewed.
I think there is such a thing as a risk tolerance. You can't build a completely trust-free computer. For practical and economic reasons, you're going to have to trust somebody. I think the optimal strategy is to be smart about who you're trusting and where you're focusing your limited resources to review. Popular Debian packages? Probably safe. Widget by person you've never heard of that nobody else uses? Probably risky.
If this makes you feel uncomfortable, I suggest that a person takes a few moments to review their threat model. What kinds of attacks are you worried about? What costs are you willing to pay to mitigate these attacks?
I would just be mindful of independently generated content. A backup will not help you if your computer is in a bot net
Why would a backup not help with a bot net? Shouldn’t rolling the computer back to its state before installing the malware remove it? (This is a genuine question; I’ve had very little exposure to actually using Linux but am interested and will probably install it on a machine someday)
Botnets work as background malware, most people never realize they're infected, as opposed to in your face malware like ransomware.
Backups are only relevant for malware if you can pinpoint when the malware was installed and the backups aren't compromised.
You would need to know your infected
Being opensource doesn't make backups an extra special requirement. Backups should be considered a compulsory, non-optional thing these days, regardless of your choice of OS. I mean, your device could crash or fail, get stolen, get damaged, get hit by crypto - anything is possible. Being opensource or not makes little difference to the question "is it best practice to backup".