4 ms·

>>getting hold of their $HOME is way more valuable >Same on Windows Windows 8 Metro/Modern/UWP apps do not have access to your home directory. What is being

by zyx321 10y ago

>>getting hold of their $HOME is way more valuable >Same on Windows Windows 8 Metro/Modern/UWP apps do not have access to your home directory. What is being done to improve the situation on the Linux side of things?

pfg 10y ago
I believe Flatpak/Snap (Fedora/Ubuntu's new app packaging formats) makes this possible quite easily. It'll take quite some time until these initiatives really take off, but then again things aren't all that different on Windows today. A typical Windows system is still one Office macro away from losing $HOME.
- raesene6 10y ago
  But then no standard desktop OS is immune to users executing code from untrusted sources, you need something more locked down like iOS for that. To get a macro running in office the user has to explicitly ignore security warnings to do it, this would be the same in linux or MacOS where code execution capabilities were present.
  - pfg 10y ago
    I'm making a comparison to Windows, and my point was that it's no different there today despite the fact that Metro apps exist (just like Flatpak/Snap exists on Linux). Walled gardens such as iOS are definitely superior in that respect. > To get a macro running in office the user has to explicitly ignore security warnings to do it, this would be the same in linux or MacOS where code execution capabilities were present. Sure, but it's pretty easy to ignore those warnings when you see something like [1] or [2]. [1]: https://3.bp.blogspot.com/-ginpmnFHC_E/V3J3kFADrxI/AAAAAAAAojc/fvWqTDGAItoCtcPBEDYBYylU7UdWYKdUgCLcB/s1600/microsoft-office-zero-day-exploit.png https://3.bp.blogspot.com/-ginpmnFHC_E/V3J3kFADrxI/AAAAAAAAo... [2]: https://pbs.twimg.com/media/CiqwqUOWgAAVTzE.jpg:large https://pbs.twimg.com/media/CiqwqUOWgAAVTzE.jpg:large
    - raesene6 10y ago
      indeed those messages are good examples of social engineering, but when comparing OS security there's nothing inherent about MacOS or Linux that would make them any more resistent to the same kind of social engineering attack. I'd suggest that the reason that there are fewer attacks of that nature on those platforms isn't down to superior OS security but less profit available to attackers, due to smaller market share and perhaps lack of a ubiquitous target app. like office.
      - pfg 10y ago
        I think you're missing my point. I'm not saying either is better in that respect (like zyx321 claims for Windows), I'm just saying they're both just as vulnerable despite the existence of sandboxed apps.

by zyx321 10y ago

pfg 10y ago

I believe Flatpak/Snap (Fedora/Ubuntu's new app packaging formats) makes this possible quite easily. It'll take quite some time until these initiatives really take off, but then again things aren't all that different on Windows today. A typical Windows system is still one Office macro away from losing $HOME.

raesene6 10y ago
But then no standard desktop OS is immune to users executing code from untrusted sources, you need something more locked down like iOS for that. To get a macro running in office the user has to explicitly ignore security warnings to do it, this would be the same in linux or MacOS where code execution capabilities were present.
- pfg 10y ago
  I'm making a comparison to Windows, and my point was that it's no different there today despite the fact that Metro apps exist (just like Flatpak/Snap exists on Linux). Walled gardens such as iOS are definitely superior in that respect. > To get a macro running in office the user has to explicitly ignore security warnings to do it, this would be the same in linux or MacOS where code execution capabilities were present. Sure, but it's pretty easy to ignore those warnings when you see something like [1] or [2]. [1]: https://3.bp.blogspot.com/-ginpmnFHC_E/V3J3kFADrxI/AAAAAAAAojc/fvWqTDGAItoCtcPBEDYBYylU7UdWYKdUgCLcB/s1600/microsoft-office-zero-day-exploit.png https://3.bp.blogspot.com/-ginpmnFHC_E/V3J3kFADrxI/AAAAAAAAo... [2]: https://pbs.twimg.com/media/CiqwqUOWgAAVTzE.jpg:large https://pbs.twimg.com/media/CiqwqUOWgAAVTzE.jpg:large
  - raesene6 10y ago
    indeed those messages are good examples of social engineering, but when comparing OS security there's nothing inherent about MacOS or Linux that would make them any more resistent to the same kind of social engineering attack. I'd suggest that the reason that there are fewer attacks of that nature on those platforms isn't down to superior OS security but less profit available to attackers, due to smaller market share and perhaps lack of a ubiquitous target app. like office.
    - pfg 10y ago
      I think you're missing my point. I'm not saying either is better in that respect (like zyx321 claims for Windows), I'm just saying they're both just as vulnerable despite the existence of sandboxed apps.