I’m the administrator of kbin.life, a general purpose/tech orientated kbin instance.

  • 0 Posts
  • 301 Comments
Joined 2 years ago
cake
Cake day: June 29th, 2023

help-circle


  • We do run .deb/.rpm files from random websites though.

    In general with Linux sites with deb/rpm/etc files would usually include hashes for the genuine versions etc. Not to say the actual author of these could be malicious.

    And you mentioned flatpak too. Appimage is quite popular too, and afaik that doesn’t have any built-in sandboxing at all.

    Even with sandboxing, they generally need access to save files/load files etc from the host environment. Where are these connections defined? Could a malicious actor for example grant their malicious appimage/flatpak more access? Genuine questions, I’ve never looked into how these work.




  • r00ty@kbin.lifetoLinux@lemmy.worldLinux Antivirus?
    link
    fedilink
    arrow-up
    14
    ·
    20 days ago

    I think there’s a few aspects to this whole subject.

    First of all for a long time people have thought Linux not to be the target of malware. I would say that it has been a target and it has been for decades. I recall in the late 90s a Linux server at work was attacked, had a rootkit, IRC trojan and attack kit installed by script kiddies in Brazil. I think the nearest you can say is that desktop users aren’t usually a target, which is mostly true. But with the share of desktop installs hitting a high recently we should expect that to change.

    Second I think most windows antivirus products (including the built in one) are doing some active useful things. Most of these are not relevant on Linux (we generally don’t run setup.exe from random websites). However! Here’s where things get interesting. The rise of flatpak and other containerised applications. These I would say are very similar to setup.exe, and would make it trivial to embed malware into such a file. A Linux virus scanner could be checking these. Also we’ve seen direct attacks on distro repositories lately. I don’t expect this to slow down. We are most certainly a target now.

    Third, the other reason most Linux users don’t use virus scanners is because they’re usually technical people who would recognise (usually) something wrong and investigate/spot the malware. I would say two things are changing here. Simpler to install distros are bringing in less technical people to Linux and, the number of processes running on a machine doing effectively nothing in a desktop environment is way higher than it used to be. So technical people can be caught off guard. Also, a rootkit can hide all of these clues if done well.

    So I would say there’s a really good space to have a well made virus scanner/antivirus now. It is probably the right time for it.






  • I note they make an exemption for the UK. Now, while the UK is no longer part of the EU we do have a version of the GDPR which includes the right of erasure and follows similar rules to the EU GDPR. And is pretty close to “The right to be forgotten”. The ICO site about it even references that phrase.

    So, I wonder why they think they get to treat us differently. I suspect I know. There are exemptions they can claim to the right of erasure (and I bet they’re similar in the EU GDPR). But here’s the difference. The UK ICO is a toothless useless organisation they know very well they can either exploit or ignore.





  • Well it is. If you get fined £50 a day for leaving your car parked in a no parking zone. And you get a notice your parking is being investigated. Do you a) Move your car to mean you “at worst” get the fine for the time you were there or b) Just leave it there, because “they’ve already got me”?

    Just because there’s a POTENTIAL for some comeback from prior infringements, doesn’t mean a good financial decision isn’t to pull out of the market to avoid future infringement actions. This is ESPECIALLY so, when there’s a new law with stricter enforcement available to the state regulator.

    My whole point has been from the start “Just trying to avoid being fined” is a financial business decision. They have multiple options. But the ones that matter are:

    1. Remove yourself from the UK market, thereby limiting exposure to future fines.
    2. Accept you will get more, significantly bigger fines and try to fight them in the courts.

    One carries less financial risk than the other. They chose the option with lower financial risk to them.

    I’m from the UK and it’s not a great situation for us. But, I also think businesses that have a genuine fear of ending up in Ofcom’s sights need to start making this kind of decision to the extent that normal people begin to feel the effect of the Online Safety act. Because that’s the only time they’re going to get the kind of backlash they need to respond to.



  • Yep, same. Well I actually remember finding the best ways to copy a game on a tape error free first. Some, without protection you could just save back to tape for a digital reproduction (and this also allowed tape to disk conversion). Actually those with non destructive copy protection could kinda be copied too if you knew a little Z80 ASM. Others, you needed to copy tape to tape and hope the quality turned out OK.

    But yes, then bringing your box of copied disks (Amiga in my case) into school and swapping with your friends was the way to go.


  • Which whether you like it or not, is a commercial decision. They cannot realistically vet people for age, because 99% of requests are unauthenticated. Who is going to make an imgur account just so they can see imgur images?

    So they made the commercial choice to avoid losing money through fines vs whatever revenue (ad based? I don’t know their model) they would earn from UK users.

    Now, ICO and Ofcom have their own reasons to play it down in this way. But, they’re also technically correct.