JohnT wrote: Thu Jul 20, 2023 10:13 am
Peter wrote: Wed Jul 19, 2023 11:33 pmisn't it risky hosting the signatures on a third party site? If Fosshub were compromised and wanted to deliver spyware to certain individuals, they could send personalized versions of both the binaries and corresponding signatures? Or does the public key make this kind of tampering impossible?
I mean, what is, where is ever safe?
- Github could be compromised from their side; both their infrastructure, or frontend, or a privilege escalation issue
- Developer accounts could be compromised and could submit rogue code
- The binaries could be swapped out, injected and the signature modified too - as you said
There is really nothing out there that guarantees that something is safe. Anti-virus was used for this, but AV programs always struggled if the code was injected for a specific purpose. Ie.: Someone created a malware just for this injection. And AV vendors are complaining now that AI is being used for generative malware too.
There is only one way to make sure something is super safe. IF something is open-source and the source code is small enough and you are a black-belt programmer, you may verify the whole source code and make sure it is safe. And then compile it for yourself. But, good luck with that with a bigger project. (For example, here, you have Qt, libtorrent, and qBittorrent itself. Three projects.)
Safety is a mindset I'd say. If you want to live in safety in the digital world, you have to severely cripple yourself, so to speak. For example, some people use Qubes OS (
https://www.qubes-os.org/) where you'd isolate programs into "Qubes". You could also run qBittorrent in Docker, and only let it access your given folders. Then again, it could infect downloaded data then. But oh you just wait. The downloaded data. Exactly. Unless you are sharing data that you well know, that is byte-by-byte the same thing you know, it might be infected as well. I've personally witnessed it happening it on even private trackers. Who can stop you from uploading some random game or program to a site, with some freshly baked malware? No one. Even if the torrents are checked, even if moderators would download it, AV detection will fail and people will carry on with their life.
Security conscious people usually run laptops with open firmwares flashed on them, with Intel ME wiped out and they run only open-source software. Not only that, some don't even use the internet. See RMS himself.
Long story short, if you want to "stay safe": Don't torrent if safety is a concern.
Sorry for the book.