On 09/06/15 11:33, Jonathan Wilkes via Pd-list wrote:
How does what you're working on compare to apt?
It's a bit like a terrible, half-assed, buggy, GUI-only version of apt written in an ancient scripting language and missing 99% of the features. It's designed to download Pd externals, Pd GUI plugins, and Pd abstractions, but not other types of software.
On the up side it runs on the same platforms as Pd does and integrates tightly with the UI. Basically the same idea though.
IOhannes yesterday submitted some feature requests for us to integrate deken with apt. Vapourware: when users are on a Debian based platform the search should also return results from an apt search so that they can optionally install externals from Debian packages instead of puredata.info. He also kicked off the "intent to package" to get deken into Debian:
https://bugs.debian.org/788075
As an Ubuntu user myself I am pretty excited about both of those things!
[Also a bit nervous at the prospect of more humans being subjected to software I wrote.]
I'd really prefer a decentralized repo to match or exceed the security properties of apt.
That would be excellent. A pie in the sky idea is one that stores packages in some type of anonymous torrent-cloud. Patches welcome!
Probably I'm thinking of the word "frictionless" in a different way than you mean it. For example, if you make the external publishing system frictionless, you greatly decrease the cost of attack. Someone can try to upload an evil external, and if they fail, they can just try again later.
Additionally, you raise the value of a successful attack. For example, an evil external could rename your tcl procs and redirect requests for any subsequent externals to an evil mirror. (And even if you don't allow writing over the tcl plugin file, those evil externals can rename the procs on Pd startup every time the user loads one of them in a patch.)
Yes, that's true.
When you let users download and run binaries compiled by arbitrary people you open them up to danger. I have thought a lot about this with respect to deken and here are what I hope are mitigating factors with some bad excuses thrown in for good measure:
- There is a warning prominently displayed when you launch the
deken externals search interface: "Only install externals uploaded by people you trust."
- Uploaders have to have an account on puredata.info which provides a
level of community accountability. The search systems tells the user which username was used when uploading the package. We can tar, gzip, and feather anybody who uploads an NSA compromised binary. Get your pitchforks & flaming rags ready everybody.
- The uploaded packages are sha256-summed and the sum is uploaded with
the package. At the moment this information is not used but in future users can verify with the developer that the same version they have is the one the developer actually uploaded, if they want.
- Vapourware: there is a feature request for optional GPG signing of
the package files. This provides an additional level of trust and verifiability where you don't actually have to ask the developer, you can just check using their public key.
- At the end of the day of course, it is about trust between users and
developers. Users who download Pd binaries from Miller's site trust that he won't inject obscure-music-nerd-spying-software from the NSA into his binaries.
- Every other package management system also faces these same issues,
as does "I am going to download this random Windows executable and double click it with impunity what could possibly go wrong". We can try for best-practice (or better!).
"I am regularly asked what the average Internet user can do to ensure his security. My first answer is usually 'Nothing; you're screwed'." -- Bruce Schneier
Jonathan, I hope your Midi-chlorians are tingling because I could sure use your TCL expertise in the form of pull-requests! :D
https://github.com/pure-data/deken/issues
Cheers,
Chris.
PS Lol: "Back in the 1980s, Yosemite National Park was having a serious problem with bears: They would wander into campgrounds and break into the garbage bins. This put both bears and people at risk. So the Park Service started installing armored garbage cans that were tricky to open -- you had to swing a latch, align two bits of handle, that sort of thing. But it turns out it's actually quite tricky to get the design of these cans just right. Make it too complex and people can't get them open to put away their garbage in the first place. Said one park ranger, 'There is considerable overlap between the intelligence of the smartest bears and the dumbest tourists.'" https://www.schneier.com/blog/archives/2006/08/security_is_a_t.html