Hacker News

points by gf000 9 hours ago | 0 comments

> In some Linux distros like Debian, everything is illegal/prohibited until you explicitly allow it

Bit of a nitpick, but this is certainly not true of their userspace, where an `npm install` can just install a keylogger or read your ssh keys, or do whatever it wants -- except for updating your video card driver.

[–] dylan604 8 hours ago

I would hope that someone deliberately choosing to run a headless Debian install would be wise enough to not go around running `npm install` willy nilly. In my personal experience, I've never once needed an `npm install` in Debian environment. I've only ever used them in server environments and to be honest thinking about it, that was all pre-npm when javascript was kept where it belonged in your browser and not my server. Someone screwed us all allowing JS on the server, but that's an entirely different conversation.

[–] gf000 8 hours ago

Well, it's enough to use a trusted app as your own user on non-trusted data. The former just has to have a memory vulnerability, which is not rare given most of it is C.

So yeah, don't be so confident in it working out. Unfortunately gnu/linux desktop is severally lacking in security (and by desktop I mean a headless personal use as well)

[–] Xirdus 5 hours ago

I used to run npm install unsupervised from a script on headless Debian that I deliberately chose dozens of times everyday. Later I moved my CI to Alpine.