Remix clone Hacker News

But those are even worse from this point of view, I have no control over which apps can access my camera, or microphone.

I'm personally disappointed that sandboxing isn't easier in Linux. I hoped it would move past Windows and Mac, imagine a world where the majority of libraries are sandboxed too, we only let compression and decompression libraries read one stream and write to another, this would improve security. This has been done by both Google (in Android) and Apple (in iOS and Mac OS X), but hasn't seen general acceptance in Linux (as far as I can tell).

▲

bee_rider 4 hours ago | parent | next [-]

Maybe if somebody made a paid version of Linux for desktops, they could pay for people to do the job of designing a sandbox and store.

It sounds like not many volunteers find it very fun (which isn’t surprising, it sounds incredibly tedious, high-stakes, and annoying to work on). This isn’t the sort of thing people do for free and it also isn’t obvious what the business model is supposed to be… the incentives aren’t here.

▲

realusername 16 hours ago | parent | prev [-]

Because on Linux, everything is based around trusted security since you have access to the sources whereas on iOS and Android, every single app you install could be a malware so those systems are based on untrusted security.

▲

danieldk 16 hours ago | parent | next [-]

That assumes that there are never zero days or other unpatched vulnerabilities. You should not trust applications because you have access to the source. Nobody is actively auditing the vast majority of open source code, well except of malicious actors who probably have a handful of remotes in a lot of RSS readers, chat apps, microblogging clients, etc., which they can use to compromise activists and journalist naive enough to trust desktop Linux.

A lot of Android vulnerabilities are bugs in open source parsers of untrusted data (open source as in AOSP or more widely used open source libraries). But the impact is smaller because Android has proper security boundaries. If desktop Linux was as popular as Android -- we would have a security disaster of epic proportions.

▲

realusername 15 hours ago | parent [-]

But in the mean time, I still trust a Linux distribution more than my phone when it comes to my private data.

My Linux distribution doesn't have a built-in advertising id, unknown manufacturer modifications I can't even look at or shady processes which have more power than I do.

I think it's time for the tech community to move beyond just the tech side and understand that security is also a social contract.

▲

0dayz 14 hours ago | parent [-]

This is just a pivot though, if you don't have good security then your privacy is worth nothing.

Irony being that Mac OS X is the best at privacy out of the commercial OS out there.

	▲	realusername 14 hours ago \| parent [-]
		In today's world, attacks on your data are much more common than targeted exploits on the kernel so I would put it in opposite order. If there's no privacy then there's no security. > Irony being that Mac OS X is the best at privacy out of the commercial OS out there. The bar is very low and OSX is still way below a Linux distribution

▲

silon42 15 hours ago | parent | prev | next [-]

IMO flatpak should assume untrusted too, unless it's a distro specific repository of strictly reviewed/controlled code (like Fedora Flatpak repo, etc).

▲

AStonesThrow 16 hours ago | parent | prev [-]

Hahaha, oh that is a hilarious attitude, you really believe that F/OSS means that implicit trust can be granted all across the supply chain. That I have access to the source makes a lick of difference in terms of vulnerabilities or exploits that can be found.

Once in college I cited Linus's Law in an impassioned apologia for Open Source. And I was duly corrected. Because Linus's Law really has no basis in reality.

https://en.wikipedia.org/wiki/Linus%27s_law

The reason Linux has such a model of blind trust in system services and applications is because it was based on Unix, which had an even more naïve model, because mostly, it was administrators and authorized users installing that stuff, there was more top-down monitoring and control, and just a smaller incidence of naked malice.

It's the same thing we see in earlier versions of Windows, or macOS, or the Internet. Look at the Internet in the mid-90s. Was it secure, with all the open source running on it? Hell naw. Every OS and protocol is vulnerable and attacked, and every OS and protocol revises security models based on modern-day threats. F/OSS saves nobody and mitigates virtually nothing.

To answer the GP, sandboxing has to be bolted-in to Linux after the fact. Linux's POSIX model is so old and needs to be so compatible. The only sandboxing in SVR3 Unix was chroot(2), you know? The Docker support and cgroups and virtualization are all new layers, and need careful integration. Nobody says that F/OSS doesn't need sandboxing. Nobody says that F/OSS is so secure that it can deviate from better-secured models. Quite the opposite.

Android and iOS are clean starts, mostly; didn't need to be backwards compatible, so they're tuned to the latest threat models of adversarial computing as you describe. But every single app you install on Linux could be a malware, too. I have no idea what "trusted security" or "untrusted security" are, but they aren't real terms of art in Cybersecurity, and they do nothing to describe the provenance or evolution of Linux security (which often has a lot of unused mitigations such as AppArmor or SELinux that get turned off right quick.)

▲

realusername 15 hours ago | parent [-]

This is kind of a sophism, of course it's not perfect (nothing is) but I'll still trust this model over Android or iOS which have a built-in advertising id, manufacturer modifications I can't even look at and shady processes which have more power than I do.

Security is also a social contract.

	▲	skydhash 7 hours ago \| parent [-]
		Yep, most house doors locks won’t survive a well placed kick, but in a safer community, that’s all people have. But in less trusting neighborhoods, everyone use steel bars on windows and have an additional steel door for every wooden one. So you still can have bad actors in the package manager model, but something like Adobe who treat user agency with contempt is less likely to happen. So I trust my distros and its maintainers more than I trust Apple. And Apple already have most of my data via iOS.