5 ms·

Interesting write up. Having seen iOS in 'The Good' section with no mention of Linux or Windows, I thought things might get interesting in "The Bad" or "The Ugl

by ademup 8y ago

Interesting write up. Having seen iOS in 'The Good' section with no mention of Linux or Windows, I thought things might get interesting in "The Bad" or "The Ugly". But there was no mention at all. That was a bit jarring, though I respect the author for omitting them if it is just ignorance in those areas. I'm not sure if there is a connection or intent, but the result may be a (tacit?) endorsement of Apple.

DyslexicAtheist 8y ago
I'm an enthusiastic Linux user (called myself evangelist the first years of using it) and was always on a mission to defend it against the dark evil empire that was Microsoft. Apple was only used by graphic design types back then. Now that I've established how much I love Linux and the FOSS movement (I'll still defend it over proprietary works) , I'm also a realist. Realist because when you do a lot of security dev then reality on Linux looks different today. Sticking for sake of discussions with monolith kind of kernels (comparing oranges with oranges) I absolutely hate the security design choices of modern Linux. Linux could do a lot better in this regard and Torvalds doesn't do the industry a favor when he calls security experts a bunch of masturbating monkeys. I can see where he comes from but the attack surface on any type of Linux (whether embedded or not), I'd go as far to call it total trash when compared to its BSD cousins. A lot of this isn't just Linux's fault considering how big the system is today. To realistically secure a Linux system is almost impossible (within budget+time that is) when compared to BSD. The only reason why I still put up with Linus is because of FOSS. But if it were purely for security (on a desktop system) I'd have to say Linux is really poor. It hasn't always been that way. My theory (really just theory) is that while Microsoft got hammered for decades for having shit security (remember trustworthycomputing.com ??). And I think the message slowly but gradually sank in at Redmond. Microsoft (and I still get hick-ups when saying it) somehow got their act together. I believe all that pressure amounted to something in the end while the Linux community missed the train. Not to say that there aren't brilliant ideas coming out of that community but there is very little pressure to provide integrated security that actually protects the user in a coherent way. You get lots of little pockets of good and bad (as is the nature of FOSS) and integrating it isn't even done well by the major distributions. Again not saying Linux can't be secure but to make it good depends a lot on who integrates and sets up the system. And for the end-user who only has a semi-technical background (never heard of threat-modeling or grsec ... for them it's a dumpster fire). I'm not comparing Linux to Apple here because Apple security is brilliant and thought all the way through to the UI/UE level. Linux in that regard doesn't even stand a chance. @thegrugq has a pretty good guide for OpSec/ComSec which is still relevant to this very day that spells out the tough reality (which a Linux fan like myself doesn't always appreciate hearing): https://news.ycombinator.com/item?id=8950875 https://news.ycombinator.com/item?id=8950875
- DyslexicAtheist 8y ago
  also this a 1000 times: "Dependency slurping systems like NPM, CPAN, go get, and so on continue to freak me out. They might potentially be more dangerous than manual dependency management, despite the huge risks of that practice, precisely because they make it ‘easy’ to grow your project’s dependency graph — and hence the number of individuals and organizations that you implicitly trust. (And their trustworthiness can suddenly change for the worse.)"
  - zzzcpan 8y ago
    Implicit trust is easy to solve by forbidding it. If someone doesn't want to maintain his project anymore, someone else could make a fork and try to promote it and try to gain trust again, but not take over that project. While this particular problem can be solved, in reality it doesn't matter, because trusting third parties with all the poor security they have is a much bigger security hole.
  - ThePhysicist 8y ago
    I always pin dependencies to fixed versions in production software, which makes it less likely that my toolchain gets poisoned by a rogue version update. Also, for languages that allow it I bundle dependencies locally (in Python e.g. using Wheels) or run my own registry proxy, which makes poisoning by registry takeover also less likely. Personally I think there are bigger threats than malicious dependencies, especially if an adversary specifically targets me. My biggest concern is what happens when someone takes over our CI/CD setup, as that gives way more access to an adversary.
- loudmax 8y ago
  How easy is it to get a BSD working on a laptop these days? Once you get past UEFI, installing Linux on a laptop isn't particularly difficult. The challenge is that drivers for wifi, audio, webcam, etc, will be very hit or miss depending on the hardware. My impression is that finding reliable drivers for BSD is even more difficult. Are there laptops that are well supported by BSD (not including including MacOS)? Thinkpads maybe?
qu4z-2 8y ago
I think it was "People updating their iOS" more than iOS unqualifiedly. If people are Patching Their Shit that seems like a security win regardless of platform.

by ademup 8y ago

DyslexicAtheist 8y ago

I'm an enthusiastic Linux user (called myself evangelist the first years of using it) and was always on a mission to defend it against the dark evil empire that was Microsoft. Apple was only used by graphic design types back then. Now that I've established how much I love Linux and the FOSS movement (I'll still defend it over proprietary works) , I'm also a realist. Realist because when you do a lot of security dev then reality on Linux looks different today. Sticking for sake of discussions with monolith kind of kernels (comparing oranges with oranges) I absolutely hate the security design choices of modern Linux. Linux could do a lot better in this regard and Torvalds doesn't do the industry a favor when he calls security experts a bunch of masturbating monkeys. I can see where he comes from but the attack surface on any type of Linux (whether embedded or not), I'd go as far to call it total trash when compared to its BSD cousins. A lot of this isn't just Linux's fault considering how big the system is today. To realistically secure a Linux system is almost impossible (within budget+time that is) when compared to BSD. The only reason why I still put up with Linus is because of FOSS. But if it were purely for security (on a desktop system) I'd have to say Linux is really poor. It hasn't always been that way. My theory (really just theory) is that while Microsoft got hammered for decades for having shit security (remember trustworthycomputing.com ??). And I think the message slowly but gradually sank in at Redmond. Microsoft (and I still get hick-ups when saying it) somehow got their act together. I believe all that pressure amounted to something in the end while the Linux community missed the train. Not to say that there aren't brilliant ideas coming out of that community but there is very little pressure to provide integrated security that actually protects the user in a coherent way. You get lots of little pockets of good and bad (as is the nature of FOSS) and integrating it isn't even done well by the major distributions. Again not saying Linux can't be secure but to make it good depends a lot on who integrates and sets up the system. And for the end-user who only has a semi-technical background (never heard of threat-modeling or grsec ... for them it's a dumpster fire). I'm not comparing Linux to Apple here because Apple security is brilliant and thought all the way through to the UI/UE level. Linux in that regard doesn't even stand a chance. @thegrugq has a pretty good guide for OpSec/ComSec which is still relevant to this very day that spells out the tough reality (which a Linux fan like myself doesn't always appreciate hearing): https://news.ycombinator.com/item?id=8950875 https://news.ycombinator.com/item?id=8950875

DyslexicAtheist 8y ago
also this a 1000 times: "Dependency slurping systems like NPM, CPAN, go get, and so on continue to freak me out. They might potentially be more dangerous than manual dependency management, despite the huge risks of that practice, precisely because they make it ‘easy’ to grow your project’s dependency graph — and hence the number of individuals and organizations that you implicitly trust. (And their trustworthiness can suddenly change for the worse.)"
- zzzcpan 8y ago
  Implicit trust is easy to solve by forbidding it. If someone doesn't want to maintain his project anymore, someone else could make a fork and try to promote it and try to gain trust again, but not take over that project. While this particular problem can be solved, in reality it doesn't matter, because trusting third parties with all the poor security they have is a much bigger security hole.
- ThePhysicist 8y ago
  I always pin dependencies to fixed versions in production software, which makes it less likely that my toolchain gets poisoned by a rogue version update. Also, for languages that allow it I bundle dependencies locally (in Python e.g. using Wheels) or run my own registry proxy, which makes poisoning by registry takeover also less likely. Personally I think there are bigger threats than malicious dependencies, especially if an adversary specifically targets me. My biggest concern is what happens when someone takes over our CI/CD setup, as that gives way more access to an adversary.
loudmax 8y ago
How easy is it to get a BSD working on a laptop these days? Once you get past UEFI, installing Linux on a laptop isn't particularly difficult. The challenge is that drivers for wifi, audio, webcam, etc, will be very hit or miss depending on the hardware. My impression is that finding reliable drivers for BSD is even more difficult. Are there laptops that are well supported by BSD (not including including MacOS)? Thinkpads maybe?

qu4z-2 8y ago

I think it was "People updating their iOS" more than iOS unqualifiedly. If people are Patching Their Shit that seems like a security win regardless of platform.