andi- has quit [Remote host closed the connection]
stigo has joined #nixos-security
andi- has joined #nixos-security
hyperreal has joined #nixos-security
<hyperreal>
Hello. I recently came across this article on macOS Homebrew security issues. Basically there is a huge attack vector from installing Homebrew into /usr/local. The attack vector is basically that someone could spoof the current user and place malicious software into the homebrew path (/usr/local) because Homebrew makes that path u+w.
<hyperreal>
Someone also said Nix would be a more secure alternative to Homebrew on macOS. However, I'm curious how this particular attack vector is closed on Nix.
<hyperreal>
a similar but larger attack vector would exist on other Linux distributions where users edit the sudoers file to give their user no passwd sudo privilege.
tilpner has quit [Ping timeout: 265 seconds]
hmpffff has joined #nixos-security
justanotheruser has quit [Read error: Connection reset by peer]
justanotheruser has joined #nixos-security
<qyliss>
hyperreal: former Homebrew maintainer here, now working with Nix. That "attack" is bullshit, and was rightly dismissed as such when it came out.
<qyliss>
/usr/local is u+w, meaning that to write into it, something malicious would need to be executing as your user
<qyliss>
you know what else something running as your user could do? write to .bash_profile and change your PATH
<qyliss>
so "fixing" this wouldn't improve security in any way
<hyperreal>
qyliss: I see! Thank you
<qyliss>
np :)
<qyliss>
To expand a little further, the UNIX security model assumes that any code running as a user is just as trustworthy as all other code running as that user
<qyliss>
I consider this archaic, but it's how most modern UNIX systems work
<qyliss>
Apple is starting to move away from that a little by restricting what root can do
<qyliss>
And restricting what executables the kernel will run
<qyliss>
And sandboxing
<qyliss>
But it's done in a way that most Unix-y programs (as opposed to Mac GUIs) take no notice, because it usually requires Apple Developer stuff, and isn't compatible with any other platform