⚗️⚗️⚗️ pnathan ⚗️⚗️⚗️ is a user on mastodon.social. You can follow them or interact with them if you have an account anywhere in the fediverse.
If you don't, you can sign up here.
The Internet Gods, 2018:
Security! Security! SSL everywhere! Mandatory two-factor authentication! Full-device encryption! Hardware on-chip secure enclaves!
The Internet Gods, also 2018:
let's just give Jeff Bezos all our private RAM, and the official Node.js installer is literally curl | sudo bash
@natecull It's been more or less "just download this crap from the internet and run whatever code it has" since the beginning of the times, so node.js just made it obvious. (Weren't RPM or deb packages signed? Well, yes, but... you know the story.)
@natecull @pnathan you could argue that, I guess. On the other hand, I suspect the ability of node.js to hold their tls certificate and possibly revoke when compromised it is maybe better than what gpg can do. If a gpg key of a debian developer is compromised, I can't really see a way how to handle it securely without manual intervention in the system. And HTTPS will probably be how you learn to do it :)
@pony apt secure makes sure the file hasn't been modified since it was uploaded. Https just secures bytes in transit. Also there's only one organization to trust unlike the hundreds of certificate authorities
curl-bash: I'm getting a script that modifies my system running as root from internet, verified and signed by a certificate stored somewhere on my system.
deb: the same.