10 ms·

The Linux desktop of today still occasionally requires teaching users how to install new udev rules so they can properly use that USB serial converter or other

The Linux desktop of today still occasionally requires teaching users how to install new udev rules so they can properly use that USB serial converter or other gadget sanely. Now imagine raising that pain to the power of 10, but instead of only weird USB or "device not found" errors nothing works anymore because "AppArmor" is blocking syscalls. I can already see the StackOverflow answer that just tells you to set it to permissive, and you know what, that fixes it everytime, too! This is just a non-starter. Maybe they should look at deploying ASLR first, it's not 2000 anymore you know. (Update: they just managed to get this done with stretch, released 4 months ago! That's only like 7 years late for a crucial actual security feature)

language 9y ago
Huh, didn't know that Debian was missing ASLR. Any idea about the reasoning there?
- staticassertion 9y ago
  What makes you think debian is missing ASLR?
  - language 9y ago
    > Update: they just managed to get this done with stretch, released 4 months ago! That's only like 7 years late for a crucial actual security feature) Dunno, taking @revelation's word for it? Mentioned they were missing it. It sounds funny to me though. I'm not a Debian user. edit: The Debian page on security features confuses me (https://wiki.debian.org/Security/Features https://wiki.debian.org/Security/Features).
AaronFriel 9y ago
Since the Year of Linux on the Desktop has still not come, perhaps major distributions would be wise not to use that as a reason not to implement security features. Last I checked, the Year of Linux on the Server has been every year for many, many years. And it's the servers and their vulnerabilities which are exposing tens of millions users information at a time, not individual Linux desktop users.
- revelation 9y ago
  Last I checked everyone running Linux on the Server has skipped ahead to containers so now very little of these syscall filtering games even apply anymore. Too late for servers, too early for desktops. That always felt like a succinct summary of SELinux.
  - chrisan 9y ago
    > Last I checked everyone running Linux on the Server has skipped ahead to containers so now very little of these syscall filtering games even apply anymore. That's a big jump. Any stats on the so called container usage by "everyone"? Even here in the HN-bubble everyone isn't running containers
digi_owl 9y ago
Funny thing is that udev is in the hands of the systemd devs, operating under the Freedesktop banner, so one would have thought they had the desktop in focus. But i guess pampering devops is so much more lucrative in the kudos department...

language 9y ago

Huh, didn't know that Debian was missing ASLR. Any idea about the reasoning there?

staticassertion 9y ago
What makes you think debian is missing ASLR?
- language 9y ago
  > Update: they just managed to get this done with stretch, released 4 months ago! That's only like 7 years late for a crucial actual security feature) Dunno, taking @revelation's word for it? Mentioned they were missing it. It sounds funny to me though. I'm not a Debian user. edit: The Debian page on security features confuses me (https://wiki.debian.org/Security/Features https://wiki.debian.org/Security/Features).

AaronFriel 9y ago

Since the Year of Linux on the Desktop has still not come, perhaps major distributions would be wise not to use that as a reason not to implement security features. Last I checked, the Year of Linux on the Server has been every year for many, many years. And it's the servers and their vulnerabilities which are exposing tens of millions users information at a time, not individual Linux desktop users.

revelation 9y ago
Last I checked everyone running Linux on the Server has skipped ahead to containers so now very little of these syscall filtering games even apply anymore. Too late for servers, too early for desktops. That always felt like a succinct summary of SELinux.
- chrisan 9y ago
  > Last I checked everyone running Linux on the Server has skipped ahead to containers so now very little of these syscall filtering games even apply anymore. That's a big jump. Any stats on the so called container usage by "everyone"? Even here in the HN-bubble everyone isn't running containers

digi_owl 9y ago

Funny thing is that udev is in the hands of the systemd devs, operating under the Freedesktop banner, so one would have thought they had the desktop in focus. But i guess pampering devops is so much more lucrative in the kudos department...