4 ms·

The thing with the Linux Desktop is that you can selectively enable SELinux, use PaX etc. and have security comparable to, if not better, than Windows 10, plus

The thing with the Linux Desktop is that you can selectively enable SELinux, use PaX etc. and have security comparable to, if not better, than Windows 10, plus the fact that Linux is a much more varied attack surface still applies. Or you can do nothing, in which case you're probably less secure.

vocworker 10y ago
Sure, extremely motivated individuals or governments might do that. But I'd still rate a distribution by it's default security settings. Being secure by default is important if you are shipping to thousands of users.
- deckiedan 10y ago
  Fedora comes with SELinux enabled by default, and is working towards more interesting sandboxing stuff for the future too.
  - pawadu 10y ago
    Ubuntu comes with AppArmor enabled by default [1]. Unfortunately its service will terminate at startup due to missing profiles [2]. This shows how much QA goes into security related stuff in a distro of this size. --- [1] https://wiki.ubuntu.com/AppArmor https://wiki.ubuntu.com/AppArmor [2] sudo apt install apparmor-profiles-extra
  - notalaser 10y ago
    Unfortunately, while SELinux itself is good, the tooling around it has to be the most atrocious, useless steaming pile of thrash in this niche. From setroubleshootd randomly deciding to eat up 100% of CPU time (and no one being able to explain exactly what it does) to the endless fun of figuring out what policycoreutils-python & friends do and how, actually doing something useful with it is somewhere between "painful" and "frustrating". If Microsoft had published something like this, they'd have been the laughing stock of the whole Linux community. I don't know anyone in my immediate circle of peers - not even people who use SELinux on servers or in products that they develop - who doesn't disable SELinux on their desktop. They're not idiots, either, nor re-booted Windows programmers that the IoT and DevOps craze has thrown into the Linux world, many of us have been using Linux since back when there was no E in RHEL.
    - deckiedan 10y ago
      Oh yes, SElinux tooling is an abomination. I feel like there should be a way to write a new set of simplified tooling on top of the kernel API. I've been running fedora at home an on my laptop for about a year now, and don't need to turn SElinux off. I only needed to add one custom role myself too, when trying to mount certain host directories as volumes in docker. Which is fair enough.
thatcat 10y ago
Where's a good place to get a general guide on every day desktop use of SELinux, PaX, etc?
- AsyncAwait 10y ago
  I'd look into Fedora and Arch Linux documentation/wiki.
- bigbugbag 10y ago
  Arch wiki is a goldmine: https://wiki.archlinux.org/index.php/Security https://wiki.archlinux.org/index.php/Security
- unhammer 10y ago
  One of the slides also mentioned at what point each distro introduced ASLR (ie. it might be worth upgrading your Ubuntu to 16.10 if you're on an older one)
dogma1138 10y ago
Windows still has better protection of credentials, it can be better protected against DMA attacks and has quite a few other tricks under its belt.
sytelus 10y ago
This is exactly the problem. You can buy Windows 10 machine and if it becomes vulnerable it's Microsoft's fault and you would count on them to fix it immediately, push out the automatic update and go on with your life. If default Linux desktop is insecure then consumer is supposed to figure out what exactly is insecure, be expert in knowing the alternatives and how to replace everything. The question isn't whether Linux desktop can be made more secure but rather why isn't it secure by default?
- AsyncAwait 10y ago
  > you would count on them to fix it immediately, push out the automatic update and go on with your life. Not only do you get security updates for your distro with the vast majority of Linux distros, but you also get it for all your 3rd party software, using the same system mechanism. They may not push the updates automatically, (you can of course set it that way), but some of us still want to be in control of what gets installed on our machines That's not to say it can't be improved, but the situation isn't quite as bad as you are painting it, ie there are mainstream distros that come hardened by default and security patches are regularly backported. I'd argue that macOS is also technologically less secure than modern Windows, yet its users are in no more danger than Windows users are, (despite its theoretically security), because security depends on a lot of factors including the user culture, market share etc. i.e. Linux doesn't have a culture of downloading executables from random websites for one. I'd guess most distributions feel like they're providing an adequate level of protection for their users as of now, without introducing too much friction. Once that is no longer the case, it's easy to turn on a few more knobs, the software is already there.
  - sytelus 10y ago
    The 3rd party software is huge problem, actually. When you do apt-get or install using Ubuntu App Store it gives a false sense of security to novice user that things are safe. This is even more problematic because there are so many things one needs to download on default desktop to be on par with default Windows. The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on.

vocworker 10y ago

Sure, extremely motivated individuals or governments might do that. But I'd still rate a distribution by it's default security settings. Being secure by default is important if you are shipping to thousands of users.

deckiedan 10y ago
Fedora comes with SELinux enabled by default, and is working towards more interesting sandboxing stuff for the future too.
- pawadu 10y ago
  Ubuntu comes with AppArmor enabled by default [1]. Unfortunately its service will terminate at startup due to missing profiles [2]. This shows how much QA goes into security related stuff in a distro of this size. --- [1] https://wiki.ubuntu.com/AppArmor https://wiki.ubuntu.com/AppArmor [2] sudo apt install apparmor-profiles-extra
- notalaser 10y ago
  Unfortunately, while SELinux itself is good, the tooling around it has to be the most atrocious, useless steaming pile of thrash in this niche. From setroubleshootd randomly deciding to eat up 100% of CPU time (and no one being able to explain exactly what it does) to the endless fun of figuring out what policycoreutils-python & friends do and how, actually doing something useful with it is somewhere between "painful" and "frustrating". If Microsoft had published something like this, they'd have been the laughing stock of the whole Linux community. I don't know anyone in my immediate circle of peers - not even people who use SELinux on servers or in products that they develop - who doesn't disable SELinux on their desktop. They're not idiots, either, nor re-booted Windows programmers that the IoT and DevOps craze has thrown into the Linux world, many of us have been using Linux since back when there was no E in RHEL.
  - deckiedan 10y ago
    Oh yes, SElinux tooling is an abomination. I feel like there should be a way to write a new set of simplified tooling on top of the kernel API. I've been running fedora at home an on my laptop for about a year now, and don't need to turn SElinux off. I only needed to add one custom role myself too, when trying to mount certain host directories as volumes in docker. Which is fair enough.

thatcat 10y ago

Where's a good place to get a general guide on every day desktop use of SELinux, PaX, etc?

AsyncAwait 10y ago
I'd look into Fedora and Arch Linux documentation/wiki.
bigbugbag 10y ago
Arch wiki is a goldmine: https://wiki.archlinux.org/index.php/Security https://wiki.archlinux.org/index.php/Security
unhammer 10y ago
One of the slides also mentioned at what point each distro introduced ASLR (ie. it might be worth upgrading your Ubuntu to 16.10 if you're on an older one)

dogma1138 10y ago

Windows still has better protection of credentials, it can be better protected against DMA attacks and has quite a few other tricks under its belt.

sytelus 10y ago

This is exactly the problem. You can buy Windows 10 machine and if it becomes vulnerable it's Microsoft's fault and you would count on them to fix it immediately, push out the automatic update and go on with your life. If default Linux desktop is insecure then consumer is supposed to figure out what exactly is insecure, be expert in knowing the alternatives and how to replace everything. The question isn't whether Linux desktop can be made more secure but rather why isn't it secure by default?

AsyncAwait 10y ago
> you would count on them to fix it immediately, push out the automatic update and go on with your life. Not only do you get security updates for your distro with the vast majority of Linux distros, but you also get it for all your 3rd party software, using the same system mechanism. They may not push the updates automatically, (you can of course set it that way), but some of us still want to be in control of what gets installed on our machines That's not to say it can't be improved, but the situation isn't quite as bad as you are painting it, ie there are mainstream distros that come hardened by default and security patches are regularly backported. I'd argue that macOS is also technologically less secure than modern Windows, yet its users are in no more danger than Windows users are, (despite its theoretically security), because security depends on a lot of factors including the user culture, market share etc. i.e. Linux doesn't have a culture of downloading executables from random websites for one. I'd guess most distributions feel like they're providing an adequate level of protection for their users as of now, without introducing too much friction. Once that is no longer the case, it's easy to turn on a few more knobs, the software is already there.
- sytelus 10y ago
  The 3rd party software is huge problem, actually. When you do apt-get or install using Ubuntu App Store it gives a false sense of security to novice user that things are safe. This is even more problematic because there are so many things one needs to download on default desktop to be on par with default Windows. The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on.