Take a look at Shai Hulud. All the attacker had was the key.

I would feel more comfortable running curl bash from a trusted provider than doing apt get from an unknown software repo. What you are trying to do is establish trust in your supply chain, the delivery vehicle is less important.

What you said is the key infra needs to get compromise. I do not need to own the PKI that issued the certs, I just need the private key of the signer. And again, this is something that happens. A lot. A software publisher gets owned, then their account is used to distribute malware.

Not sure how else to explain this. Look at the CISA bulletin on Shai-Hulud the attacker published valid and signed binaries that were installed by hundreds of users.

"CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.[i]

After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[ii]

The malware then:

• Exfiltrated the harvested credentials to an endpoint controlled by the actor.
• Uploaded the credentials to a public repository named Shai-Hulud via the GitHub/user/repos API.
• Leveraged an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry.[iii]"

If I can control your infra I can alter what is a valid signature. It has happened. It will happen again. Digital signatures are not sufficient by themselves to prevent supply chain risks. Depending on your threat model, you need to assume advanced adversaries will seek to gain a foothold in your environment by attacking your software supplier. in these types of attacks threat actors can and will take control over the distribution mechanisms deploying trojaned backdoors as part of legitimately signed updates. It is a complex problem and I highly encourage you to read the NIST guidance to understand just how deep the rabbit hole goes.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Signatures do not help if your distribution infra gets compromised. See Solarwinds and the more recent node.js incidents.

Yes this has risks. At the same time anytime you run any piece of software you are facing the same risks, especially if that software is updated from the internet. Take a look at the NIST docs in software supply chain risks.

“Without the option of “clean” natural gas, Sweden turned to district heating – an idea which had originated in New York in the 19th century. But Sweden committed to it in a big way during the 1960s and ‘70s, deciding it was the best way to meet the heating needs of the 1 million homes now being built. This decision shaped the way homes in Sweden are heated: today, some 90% of its multi-family apartment blocks are connected to district heating systems – with heat distributed from power plants (usually on the edge of cities) as hot water via a network of pipes.”

So its like Ntop for Kubernetes? Is it better than Ntop?

Fair point. I have worn many hats through my IT career, I started out as a Windows NT admin back when it was cutting edge technology in the 90s. I fell in love with a text editor called Ultraedit that my org had a site license for. When I left that org after many years I missed Ultraedit and was delighted to find Notepad++ had most of features I loved. Now the course of my career has found me become a Linux admin and personal linux user for many years now. I have been using Notedpad-qq for years, but recently it seems to have gotten worse and I have had instances where crashes resulted in lost data. I liked the idea of having the same general UI and features as Notepad++ because I still need to use Windows at work. But I am reluctantly admitting maybe it is a time for a change.

Apologies for the digression, but I wanted to share some of the waypoints in my journey that influenced my personal choice.

I have gotten a lot of great feedback to this post, but if I had to give points for the most spot-on answer, you would get it. Thanks!

Pretty much everyone at work is using VSCode, maybe this is a good opportunity to dive in, thanks.

I see it is Platinum on WineHQ, will give that a try thanks.

https://appdb.winehq.org/objectManager.php?sClass=application&iId=2983

I have been using kate a bit and it has been a decent experience so far.

Just salt works too.

Run a live version of kubuntu from a usb drive to confirm wifi/lan drivers work and you can access the internet.

Not sure why you got downvoted, it is a fair question. Real time multiuser editing is a powerful feature. That said it is really only needed a small fraction of the time for specific types of collaboration. Also, it can cause problems as well. Libreoffice Calc meets most of my home spreadsheet needs: calculating mortgage rates and future value of investments and such.

You can tunnel over SSL with stunnel. TCP latency can be brutal though.

Typically the GPL covers the source code. Compiled, packaged and branded binaries are sometimes licensed separately. This is how Red Hat works for example.

I feel like OP missed an opportunity to title this post “Fedora Flatpaks Fall Flat”

Great article, BTW