(untitled) lainchan / sec ---------------------------------------------------------------------- BloodCat · 2021-10-17 06:28 Today, I read this site, https://itvision.altervista.org/why.linux.is. not.ready.for.the.desktop.current.html This site explains me about how Linux's security is worse than other major OS. Absolutely, Windows' security is better. Because it had more experienced fighting malicious programs. But I can't, Because It has most users in major OS and this makes Windows become a largest target. So I decided to stay in Linux, But how can I make my Linux more secure? Should I disconnect from Internet? What can I do my best? ---------------------------------------------------------------------- Nell · 2021-10-17 07:48 >>17677 Security and isolation on monolithic kernel systems is a joke and will never work because ambient authority without any real isolation is inherent to their design. Software also cannot be assumed flawless, so it will remain vulnerable. Regardless how much Windows might try to isolate software, the attack surface from a single compromised program is simply too large to meaningfully guarantee anything. Qubes is the best we've got until seL4 and genode get going enough (and Qubes could just move to use those as its backend instead). ---------------------------------------------------------------------- Sipho Nkosi · 2021-10-17 07:58 >>17678 Then how about selinux? Does that actually work well like people choosing fedora cuz it's preinstalled selinux? ---------------------------------------------------------------------- Liet Kynes · 2021-10-17 08:04 >>17679 SELinux can still be bypassed by additional bugs. It helps, but ultimately it's patching holes in what can best be described as a gigantic sieve. ---------------------------------------------------------------------- Gyula Kovacs · 2021-10-17 10:17 >>17678 >Qubes is the best we've got until seL4 and genode get going enough (and Qubes could just move to use those as its backend instead). Sounds interesting. How many years do you think will that take? ---------------------------------------------------------------------- Ivan Horvat · 2021-10-17 14:27 > microkernels Why isn't GNU Hurd more actively developed? https://www.gnu.org/software/hurd/ https://www.gnu.org/software/hurd/microkernel/mach/gnumach.html >>17677 >https://itvision.altervista.org/why.linux.is.not.ready.for.the.deskto p.current.html Also read the UNIX Hater's Book. ---------------------------------------------------------------------- Netrunner · 2021-10-17 14:55 >>17683 because Urbit is . rather than redesign the stack , start by redesigning the language . ---------------------------------------------------------------------- Agent Smith · 2021-10-17 14:57 start by making an internationally neutral programming language like APL except with a minimal instruction set which can constitute more abstract languages , like the relationship Nock has to Hoon . ---------------------------------------------------------------------- Jane Doe · 2021-10-17 16:42 >>17677 I mean, security is a fickle thing. All operating systems are vulnerable to some degree, and often in very specific ways unique to their userbase. For example, social engineering attacks have traditionally worked best on MacOS users, since their entire threat model revolves around trusting their computer to handle security. Windows machines are best gamed when you engage in guerrilla warfare, turning the OS against it's user. Again, the average Windows user really only worries about what they download/install, and the rest is supposedly "just default". Linux is in a decidedly different position. For starters, your attacker will almost always be familiar with Unix above anything. Moreso than MacOS or Windows attackers, your box gives them the homefield advantage as much as it gives you one. On top of that, almost every Linux installation is wildly different, meaning that it's basically impossible to "harden" a Linux distribution in any meaningful way. Like they mentioned upthread, your best option to assuage this paranoia is using a system like Qubes. Qubes isn't a practical solution for most Linux users though, so I'd advise spending some time thinking about your own threat model. The biggest disadvantage Mac and Windows users have is hubris, which you can easily escape as a Linux user. Understand the vulnerabilities of your system and work around them as best you can. Assume that your threat actor knows more about your system than you do. Don't neglect hardware mitigations, either: throw a password on your BIOS, encrypt every drive with LUKS, and perhaps consider immobilizing devices when they aren't in use (Kensington locks are quite cheap nowadays). These are all sane options for reducing your attack surface and helping you sleep at night. Ultimately though, yes, Linux has much worse security than MacOS and Windows. As was also mentioned upthread, a monolithic kernel being maintained for both server and desktop use will have monumental security conceits to keep the updates moving at a reasonable pace. The upside of this is that your computer is vastly more extensible than your average NPCs. "Security through obscurity" is still a helpful adage to live by, especially if your adversaries are Glowies. ---------------------------------------------------------------------- Otto Normalverbraucher · 2021-10-17 17:06 >>17683 GNU Hurd isn't exactly focused on being a security microkernel for one, and the base it chose to build its microkernel on is also pretty contentious among the microkernel crowd (it's definitely not the most performant). ---------------------------------------------------------------------- Unspecified · 2021-10-17 17:09 >>17684 Given it requires Ethereum blockchain and therefore probably also always requires networking like Windows 11, I'm not interested. ---------------------------------------------------------------------- Splicer · 2021-10-19 01:04 >>17684 holy soykaf, I haven't heard urbit in yeeeeears I still get emails from them lmao ---------------------------------------------------------------------- Wintermute · 2021-10-19 03:50 >>17678 >>17686 But wouldn't Qubes be targeted because Snowden publicly recomended it? ---------------------------------------------------------------------- Nanashi No Gombe · 2021-10-19 04:21 >>17713 So? Everything is targeted, especially things which purport to aid security and privacy. Sanity of the design and code is therefore primordial. ---------------------------------------------------------------------- Turner · 2021-10-19 05:10 >>17707 They seem more alive than ever. They just did a conference. Stars are increasing in value. Maybe there is something to it. Not sure how the security compares to anything though... ---------------------------------------------------------------------- Unspecified · 2021-11-07 09:35 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I have read over the points presented by the article. Many of the points are totally moot or look at how products external to Linux relate to Linux from the wrong perspective. A non-trivial number of the concerns expressed are valid but lack the light of greater understanding. Some of the points raised boil down to "I don't like that this is so" yet don't point out any actual problem. As someone with over 20 years of operating systems including but not limited to Unix (OpenSolaris, illumos, OpenBSD) and Unix-like (countless GNU/Linux distros) experience, macOS, and Windows in environments ranging from out-in-the-field offensive security, startups, and strict and enterprise environments. Nowadays much of my focus is on DoD-compliant architecture on major cloud providers and FedRAMP compliancy for both cloud and bare-metal (private-cloud) deployments in datacenters. I have run BSD or GNU/Linux on the desktop (laptop) by conscious choice or more specifically out of sober recognition of the necessity to protect the integrity of the services I have provided for my clients or organizations I have served. When you know people who have real money (not the guy in the nicer neighborhood who drives a bmw, but REAL money) you can't fuarrrk around. If running a right-angled USB cable from the side of my laptop to a USB-attached WiFi chip broken open and soldered to a custom antenna mounted on the back of my laptop's display is what I need to do to avoid running a mini PCI-E WiFi card with binary blobs on it that is what I am going to do. There are many of us out there that use our computers for accomplishing real-world work that actually matters, contrast to those who are more preoccupied with sucking cock. There is much pragmatic real-world perspective missing from this article. A simple example is "I want my Nvidia card to work", to which a valid counterpoint is "when Apple packages a Macintosh desktop for you, does Apple choose a very exactly sourced GPU from the most cooperative vendor with a very exact PCI-ID or does Apple pull whatever random card retailed on NewEgg that EVGA shat out?". If you want to be an adult using any operating system you don't buy random soykaf hardware with uncertainty that a decent operating system will just take whatever soykaf hardware you happened to buy, you by the hardware for the software you want to run and not the other way around. Nothing in the article presents a legitimate claim against Linux' security model nor how Linux desktop applications are secured in real- world practice. Anyone who knows what they are doing with https://firejail.wordpress.org on Linux with a sane kernel configuration (any popular distro stable kernel) will be totally fine. I will post a more thorough response to this thread in the near- future. Some of the points made in the article are legitimate and those will be addressed. The less-than-sophisticated points in the article will also be addressed. -----BEGIN PGP SIGNATURE----- iHUEARMIAB0WIQQyudGgHG89KhA6eKaAyah5Errk5wUCYYec3QAKCRCAyah5Errk 58zsAP93eCiBpJEHOa3TNMiWOm/jaLrGRpcXjQAGzJ7AaHTfJwD+Lev3uacvzwCl Zx8izV+VhFkpUBuYYXACLCmB330BsuE= =0x+J -----END PGP SIGNATURE----- A base64-encoded copy of the message + signature above and the public key are in the two base64-encoded strings below. LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLQpIYXNoOiBTSEEyNTYKCkkgaG F2ZSByZWFkIG92ZXIgdGhlIHBvaW50cyBwcmVzZW50ZWQgYnkgdGhlIGFydGljbGUuICBN YW55IG9mIHRoZSBwb2ludHMgYXJlIHRvdGFsbHkgbW9vdCBvciBsb29rIGF0IGhvdyBwcm 9kdWN0cyBleHRlcm5hbCB0byBMaW51eCByZWxhdGUgdG8gTGludXggZnJvbSB0aGUgd3Jv bmcgcGVyc3BlY3RpdmUuICBBIG5vbi10cml2aWFsIG51bWJlciBvZiB0aGUgY29uY2Vybn MgZXhwcmVzc2VkIGFyZSB2YWxpZCBidXQgbGFjayB0aGUgbGlnaHQgb2YgZ3JlYXRlciB1 bmRlcnN0YW5kaW5nLiAgU29tZSBvZiB0aGUgcG9pbnRzIHJhaXNlZCBib2lsIGRvd24gdG 8gIkkgZG9uJ3QgbGlrZSB0aGF0IHRoaXMgaXMgc28iIHlldCBkb24ndCBwb2ludCBvdXQg YW55IGFjdHVhbCBwcm9ibGVtLgoKQXMgc29tZW9uZSB3aXRoIG92ZXIgMjAgeWVhcnMgb2 Ygb3BlcmF0aW5nIHN5c3RlbXMgaW5jbHVkaW5nIGJ1dCBub3QgbGltaXRlZCB0byBVbml4 IChPcGVuU29sYXJpcywgaWxsdW1vcywgT3BlbkJTRCkgYW5kIFVuaXgtbGlrZSAoY291bn RsZXNzIEdOVS9MaW51eCBkaXN0cm9zKSBleHBlcmllbmNlLCBtYWNPUywgYW5kIFdpbmRv d3MgaW4gZW52aXJvbm1lbnRzIHJhbmdpbmcgZnJvbSBvdXQtaW4tdGhlLWZpZWxkIG9mZm Vuc2l2ZSBzZWN1cml0eSwgc3RhcnR1cHMsIGFuZCBzdHJpY3QgYW5kIGVudGVycHJpc2Ug ZW52aXJvbm1lbnRzLiAgTm93YWRheXMgbXVjaCBvZiBteSBmb2N1cyBpcyBvbiBEb0QtY2 9tcGxpYW50IGFyY2hpdGVjdHVyZSBvbiBtYWpvciBjbG91ZCBwcm92aWRlcnMgYW5kIEZl ZFJBTVAgY29tcGxpYW5jeSBmb3IgYm90aCBjbG91ZCBhbmQgYmFyZS1tZXRhbCAocHJpdm F0ZS1jbG91ZCkgZGVwbG95bWVudHMgaW4gZGF0YWNlbnRlcnMuICBJIGhhdmUgcnVuIEJT RCBvciBHTlUvTGludXggb24gdGhlIGRlc2t0b3AgKGxhcHRvcCkgYnkgY29uc2Npb3VzIG Nob2ljZSBvciBtb3JlIHNwZWNpZmljYWxseSBvdXQgb2Ygc29iZXIgcmVjb2duaXRpb24g b2YgdGhlIG5lY2Vzc2l0eSB0byBwcm90ZWN0IHRoZSBpbnRlZ3JpdHkgb2YgdGhlIHNlcn ZpY2VzIEkgaGF2ZSBwcm92aWRlZCBmb3IgbXkgY2xpZW50cyBvciBvcmdhbml6YXRpb25z IEkgaGF2ZSBzZXJ2ZWQuICBXaGVuIHlvdSBrbm93IHBlb3BsZSB3aG8gaGF2ZSByZWFsIG 1vbmV5IChub3QgdGhlIGd1eSBpbiB0aGUgbmljZXIgbmVpZ2hib3Job29kIHdobyBkcml2 ZXMgYSBibXcsIGJ1dCBSRUFMIG1vbmV5KSB5b3UgY2FuJ3QgZnVjayBhcm91bmQuICBJZi BydW5uaW5nIGEgcmlnaHQtYW5nbGVkIFVTQiBjYWJsZSBmcm9tIHRoZSBzaWRlIG9mIG15 IGxhcHRvcCB0byBhIFVTQi1hdHRhY2hlZCBXaUZpIGNoaXAgYnJva2VuIG9wZW4gYW5kIH NvbGRlcmVkIHRvIGEgY3VzdG9tIGFudGVubmEgbW91bnRlZCBvbiB0aGUgYmFjayBvZiBt eSBsYXB0b3AncyBkaXNwbGF5IGlzIHdoYXQgSSBuZWVkIHRvIGRvIHRvIGF2b2lkIHJ1bm 5pbmcgYSBtaW5pIFBDSS1FIFdpRmkgY2FyZCB3aXRoIGJpbmFyeSBibG9icyBvbiBpdCB0 aGF0IGlzIHdoYXQgSSBhbSBnb2luZyB0byBkby4gIFRoZXJlIGFyZSBtYW55IG9mIHVzIG 91dCB0aGVyZSB0aGF0IHVzZSBvdXIgY29tcHV0ZXJzIGZvciBhY2NvbXBsaXNoaW5nIHJl YWwtd29ybGQgd29yayB0aGF0IGFjdHVhbGx5IG1hdHRlcnMsIGNvbnRyYXN0IHRvIHRob3 NlIHdobyBhcmUgbW9yZSBwcmVvY2N1cGllZCB3aXRoIHN1Y2tpbmcgY29jay4KClRoZXJl IGlzIG11Y2ggcHJhZ21hdGljIHJlYWwtd29ybGQgcGVyc3BlY3RpdmUgbWlzc2luZyBmcm 9tIHRoaXMgYXJ0aWNsZS4gIEEgc2ltcGxlIGV4YW1wbGUgaXMgIkkgd2FudCBteSBOdmlk aWEgY2FyZCB0byB3b3JrIiwgdG8gd2hpY2ggYSB2YWxpZCBjb3VudGVycG9pbnQgaXMgIn doZW4gQXBwbGUgcGFja2FnZXMgYSBNYWNpbnRvc2ggZGVza3RvcCBmb3IgeW91LCBkb2Vz IEFwcGxlIGNob29zZSBhIHZlcnkgZXhhY3RseSBzb3VyY2VkIEdQVSBmcm9tIHRoZSBtb3 N0IGNvb3BlcmF0aXZlIHZlbmRvciB3aXRoIGEgdmVyeSBleGFjdCBQQ0ktSUQgb3IgZG9l cyBBcHBsZSBwdWxsIHdoYXRldmVyIHJhbmRvbSBjYXJkIHJldGFpbGVkIG9uIE5ld0VnZy B0aGF0IEVWR0Egc2hhdCBvdXQ/Ii4gIElmIHlvdSB3YW50IHRvIGJlIGFuIGFkdWx0IHVz aW5nIGFueSBvcGVyYXRpbmcgc3lzdGVtIHlvdSBkb24ndCBidXkgcmFuZG9tIHNoaXQgaG FyZHdhcmUgd2l0aCB1bmNlcnRhaW50eSB0aGF0IGEgZGVjZW50IG9wZXJhdGluZyBzeXN0 ZW0gd2lsbCBqdXN0IHRha2Ugd2hhdGV2ZXIgc2hpdCBoYXJkd2FyZSB5b3UgaGFwcGVuZW QgdG8gYnV5LCB5b3UgYnkgdGhlIGhhcmR3YXJlIGZvciB0aGUgc29mdHdhcmUgeW91IHdh bnQgdG8gcnVuIGFuZCBub3QgdGhlIG90aGVyIHdheSBhcm91bmQuCgpOb3RoaW5nIGluIH RoZSBhcnRpY2xlIHByZXNlbnRzIGEgbGVnaXRpbWF0ZSBjbGFpbSBhZ2FpbnN0IExpbnV4 JyBzZWN1cml0eSBtb2RlbCBub3IgaG93IExpbnV4IGRlc2t0b3AgYXBwbGljYXRpb25zIG FyZSBzZWN1cmVkIGluIHJlYWwtd29ybGQgcHJhY3RpY2UuICBBbnlvbmUgd2hvIGtub3dz IHdoYXQgdGhleSBhcmUgZG9pbmcgd2l0aCBodHRwczovL2ZpcmVqYWlsLndvcmRwcmVzcy 5vcmcgb24gTGludXggd2l0aCBhIHNhbmUga2VybmVsIGNvbmZpZ3VyYXRpb24gKGFueSBw b3B1bGFyIGRpc3RybyBzdGFibGUga2VybmVsKSB3aWxsIGJlIHRvdGFsbHkgZmluZS4KCk kgd2lsbCBwb3N0IGEgbW9yZSB0aG9yb3VnaCByZXNwb25zZSB0byB0aGlzIHRocmVhZCBp biB0aGUgbmVhci1mdXR1cmUuICBTb21lIG9mIHRoZSBwb2ludHMgbWFkZSBpbiB0aGUgYX J0aWNsZSBhcmUgbGVnaXRpbWF0ZSBhbmQgdGhvc2Ugd2lsbCBiZSBhZGRyZXNzZWQuICBU aGUgbGVzcy10aGFuLXNvcGhpc3RpY2F0ZWQgcG9pbnRzIGluIHRoZSBhcnRpY2xlIHdpbG wgYWxzbyBiZSBhZGRyZXNzZWQuCi0tLS0tQkVHSU4gUEdQIFNJR05BVFVSRS0tLS0tCgpp SFVFQVJNSUFCMFdJUVF5dWRHZ0hHODlLaEE2ZUthQXlhaDVFcnJrNXdVQ1lZZWMvUUFLQ1 JDQXlhaDVFcnJrCjV6NU9BUUQ2U3ZzVVpnOGZWVzNjS1ZCRmxsdnUxZTFlOVpFSlRjZXIr ZVZpSFpyT2pnRCtMa2paMC9NVzBrcDQKNXNnZHRtTUYzYWFLS2dDUDJVeE9xb0ZYdm1WZV VkYz0KPXE3djEKLS0tLS1FTkQgUEdQIFNJR05BVFVSRS0tLS0tCg== LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgptRThFWVllWDJCTUZLNE VFQUFvQ0F3Um1HNEJRWFlwYnhlS28zTzZzQjVQNHhxQkZEWldUN1NSVGU0Rlltb2tRCkxr WmZCOXQwNTd0T0F6N0dIL3duMVZsSGNFRExkTk1XTHoyOUhhZFVlcVFodENGVmJtbDRJRW x1WkhWemRISnAKWVd3Z1UzbHpkR1Z0Y3lCVmJteHBiV2wwWldTSW1nUVRFd2dBUWhZaEJE SzUwYUFjYnowcUVEcDRwb0RKcUhrUwp1dVRuQlFKaGg1ZllBaHNEQlFrRHdtY0FCUXNKQ0 FjQ0F5SUNBUVlWQ2drSUN3SUVGZ0lEQVFJZUJ3SVhnQUFLCkNSQ0F5YWg1RXJyazU2a0JB UUNMUFE5TU02RWlhMlRXVy9SUC8yaXhBZXYvc2dzRnJZdmRCZ0pzbzMxU3h3RC8KYVpJUU h0dDBTOGxpYzlMU2tyN3A4VmZ1M3VMUXpZTTg2STJRRE4zNXVDTzRVd1JoaDVmWUVnVXJn UVFBQ2dJRApCR1FjZVlhWmZFNVBOeTEydElaTzdZaHczdnZMbmdnZDZoeFVreloyanppMF BPeGcwTkRtWUFndkR5TDJTb2ZJClpQYmQ3bHBoL0NrK3l4aXgrM2U0djNrREFRZ0hpSDRF R0JNSUFDWVdJUVF5dWRHZ0hHODlLaEE2ZUthQXlhaDUKRXJyazV3VUNZWWVYMkFJYkRBVU pBOEpuQUFBS0NSQ0F5YWg1RXJyazV4azFBUDlKaWM4d2p3b2U2MFNGVDQvVApxbEtncmUr K1hiNTdNd0VNWE9DeEovZkJ2Z0VBMDh3d2dpTkliM2NHY243SXdpS3FMNVJ1Z0tLdjRESH hITDBGClRtTktTZlk9Cj1ld2dsCi0tLS0tRU5EIFBHUCBQVUJMSUMgS0VZIEJMT0NLLS0t LS0K ---------------------------------------------------------------------- Joey · 2021-11-07 09:38 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The correct URL for Firejail is https://firejail.wordpress.com/ and not https://firejail.wordpress.org -----BEGIN PGP SIGNATURE----- iHUEARMIAB0WIQQyudGgHG89KhA6eKaAyah5Errk5wUCYYeeRwAKCRCAyah5Errk 59lEAQD56M69Hng3qdcy+hMTWDKJ0FdOqydQPEOTEgzemYEhJwD/dBgt8d62D8mL C3UoB+zXLbz9NoN0Sq5b7BvWzGNo1Ig= =/3Hr -----END PGP SIGNATURE----- ---------------------------------------------------------------------- Unix Industrial Systems Unlimited · 2021-11-07 09:59 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Now that I am finished fully reading the article I am moderately disappointed that I spent time reading it. The author of the article is transparently geek-squad tier in technical proficiency and IT relevance. The auther has some very serious misunderstandings about how GNU/Linux and other operating systems are used in the real-world outside of environments no more sophisticated than a community college as encountered by IT help desk. Put simply, the article is midwit tier to the max. I am responding to the article for the benefit of those who had the misfortune of being exposed to the article. I do have real work to get done right now but as promised I will in the near enough future post a full response to the article on this thread. -----BEGIN PGP SIGNATURE----- iHUEARMIAB0WIQQyudGgHG89KhA6eKaAyah5Errk5wUCYYejgQAKCRCAyah5Errk 5y7FAPoCIEIIH6N5nqYFyNsGDyYuGTSCU0xS4zXQIJ0hYjyIIgEA3CL7NEkYbtHb 1G71yj5x3RYQ5MiQiavNRBtinYxh0OA= =KuIS -----END PGP SIGNATURE----- ---------------------------------------------------------------------- Lady 3Jane.. · 2021-11-07 10:52 Why must lainniggers fall for obvious bait so hard?