Re: Getting started with GWL 0.3.0

[zimoun <zimon.toutoune@gmail.com>]

Hi,

On Mon, 22 Mar 2021 at 16:07, Konrad Hinsen <konrad.hinsen@fastmail.net> wrote:
> zimoun <zimon.toutoune@gmail.com> writes:

> The vulnerability level is the same, but a typical user's expectations
> are not. When I run a script via "guix repl", it is perfectly obvious to
> me that that script is not part of Guix. When I run the command "foo",
> it is also perfectly obvious to me that "foo" is not part of Guix. But
> "guix workflow" looks as if it were part of Guix.
>
> Guix users need a significant level of trust in Guix and its developers
> in order to use Guix. Attackers could exploit this trust by tricking
> users into adding malicious code (via a channel, for example) that takes
> the form of a Guix extension. People do run downloaded bash scripts
> with root permissions, after all (e.g. for installing Guix ;-).
>
> > And if you worry, I guess you can run GWL in a container, something like;
> >
> >   guix environment -C --ad-hoc gwl -- guix workflow
>
> Sure, but that's not the issue. The issue is being aware that I have no
> particular reason to trust "guix workflow" as much as I trust "guix
> package".

[...]

> Imagine a package "bitcoin-utils" that installs, among lots of other
> stuff, an extension "guix pul" that starts a bitcoin-mining background
> process whenever an unsuspecting user mistypes a frequent Guix command.

Well, I understand your concerns but I am not convinced to share them.

IIUC, you are saying that "git annex" or "git lfs" which are
extensions to Git are a security issue because if any malware-package
providing a "git-pul" malware, then a user typing "git pul" with a
typo can have bad surprise.  But at first, you need to trust a channel
providing this malware-package, then second  you need to install this
malware-package and third make the typo.

And what about "guxi pull" where the typo is not on the subcommand but
on the command itself?

To me, being handy beats the concern. :-)  It is the responsability of
the user to know what they is installing and running on their own
machine.


Cheers,
simon