Ask HN: How to deal with security implications of running/installing projects?

Posted by johng 14 hours ago

There are so many neat projects coming out on HN/Github, etc. But, it's so easy to inject back doors and malware into software projects now a days. I'm wondering how people deal with the secrutiy of this. Even if you install them under docker, if it's run by root it seems like there are ways they can get root access on the box.

I see so many neat projects here I'd like to try out but I'm worried that I may install some malware or backdoored software on here. There are a few AI harnesses, terminals, etc. that keep coming up that look neat... but at the very least they'd be able to get your Claude credentials, if not worse.

I'm just wondering with so much stuff coming out, most of it AI coded.

Just wondering how people deal with it? What's the best sandbox way of testing it if that's the solution?

Comments

Comment by bitbasher 11 hours ago

A simple qemu virtual machine is nice and quick to spin up. I mainly work inside an openbsd or linux virtual machine. I use a different vm for each project and I have a "sandbox" vm I use to run random things I download/test.

Comment by gabrielsroka 12 hours ago

https://dl.acm.org/doi/10.1145/358198.358210

Comment by ebcode 13 hours ago

Have you tried VirtualBox? That’s my go-to for running un-trusted code. Start with a clean VM/fresh install, and don’t put any secrets in it.

Comment by johng 12 hours ago

I think that might be the only way. That or maybe even this? https://github.com/89luca89/distrobox

Comment by afpx 11 hours ago

I assume that if it's not air-gapped, it's compromised. I keep important stuff offline.

Comment by fsflover 13 hours ago

Have you considered Qubes OS, https://qubes-os.org? It is more secure than Xen, which it relies on, https://www.qubes-os.org/security/xsa/#statistics.

Comment by johng 13 hours ago

I've always been interested in Qubes OS but it definitely seems like a very high pain point. I can see installing these things on VM's and then maybe trying to inspect traffic outbound to see if there is something untoward, but even that can be hidden pretty well.

Hell, I've installed some older "known good" packages and some of them have so many dependencies that are pulled in automatically, the app itself could be good but one of the obscure dependencies that it requires could be hacked and now you are still running hacked software. It just seems really scary to install nearly anything now. AI can inject an obfuscated backdoor in seemingly good software, and it can spread at a speed that humans couldn't have back in the day. I'm just hesitant with new software now and it's kind of sad. So much stuff I want to test but I'm afraid to test it.

Comment by handedness 10 hours ago

Give Qubes OS a shot. It's significantly less challenging to run than it used to be, and a (small, I admit) number of us daily drive it. Hardware support these days, while far from perfect, is much better. It's not the daunting slog to get it going that it used to be.

Provided you aren't looking to run accelerated graphics or care about integrated Bluetooth, you should be fine. I'd recommend any Intel laptop (and some AMDs) with built-in Ethernet, just in case it doesn't like the Wi-Fi card. Install with kernel-latest (it's a simple option when you boot into the installer ISO), and try it out. Grab a T480/T480s if you have one handy, and you may be surprised.

Comment by johng 7 hours ago

I have a bunch of desktops and mini desktops I have laying around I can try it on. I'm assuming it works on most Linux hardware, except maybe the wifi? For example I have a few Beelink GK Minis and Geekom computers.

Comment by handedness 6 hours ago

Generally speaking, if your Wi-Fi works on Debian and/or Fedora, it should work on Qubes OS. There are exceptions to that, of course.

On a desktop PC you'll have to make some tradeoffs versus most laptops, namely integrating sys-net and sys-usb, but the installer will handle that for you. You'll want to auto-accept your keyboard and mouse, and try not to shut down sys-net. But you'll learn. Since your concern is isolating software you're running, and not necessarily isolating untrusted USB devices, that's not a big loss.

Give it a shot on a few machines and report back. Even better, try it and submit HCL reports to inform others: https://www.qubes-os.org/hcl/ Intel is generally easier than AMD, but I've run it on pretty modern AMD mobile chipsets with a lot of success.

Again, kernel-latest is your friend, and look online to see if anyone recommends any particular kernel flags.