5 ms·

I don't understand. Some Linux machines I'm responsible for are targets. I build what few things I need from source in a sandbox, fetch the source from entities

I don't understand. Some Linux machines I'm responsible for are targets. I build what few things I need from source in a sandbox, fetch the source from entities I trust and verify the integrity. And yes, I do read the code, because if I'm building it that usually means I needed to patch it.

TeMPOraL 8y ago
So your Linux machines are like military facilities in the middle of nowhere. Guarded and hard to break into. But most people's Linux machines aren't like that. Most people don't build in a sandbox, don't verify trust chains and integrity, don't read the code. It's configure && make && sudo make install. This works because evildoers and assholes are too busy ruining lives of people using Windows, Android and iOS (and, increasingly, MacOS) to notice the small and tech-savvy Linux crowd.
- flukus 8y ago
  Most people install from the Ubuntu software centre or the distros equivalent which is vetted software, just like apples store. It's been that way since before there was an Apple app store. Even for power users configure and make is a last resort or something only developers will do for specific reasons. You have a strange idea of what desktop Linux is like.
  - geofft 8y ago
    You don't think desktop Linux users use pip or npm? (Also, speaking as a distro packager, we don't do as much vetting as Apple does and we certainly don't do as much sandboxing. We're generally volunteers.)
    - glennpratt 8y ago
      So you've moved beyond the security on the mechanisms of software installation to just saying you trust Apple and don't trust open source software. That's all this boils down to.
    - flukus 8y ago
      > You don't think desktop Linux users use pip or npm? Most won't, only developers. Even there I'd say linux has an advantage because many of the dependencies in tools like that can be included by the distro itself. It hasn't worked well in practice so far but in theory it's a better solution. This is also identical across operating systems so it's hardly an example of one being superior to the other. > Also, speaking as a distro packager, we don't do as much vetting as Apple does and we certainly don't do as much sandboxing. I'm sure the vetting could be much stricter, but so far in practice it has not been an issue so I continue to trust responsible distros (debian, redhat, not arch). I'd also hope some distros like redhat are doing a lot more vetting.
- glennpratt 8y ago
  The middle of nowhere is not accurate. They have users, who are not experts, and attackers constantly. And they are much more vanilla Linux distro than I think you expect.

TeMPOraL 8y ago

So your Linux machines are like military facilities in the middle of nowhere. Guarded and hard to break into. But most people's Linux machines aren't like that. Most people don't build in a sandbox, don't verify trust chains and integrity, don't read the code. It's configure && make && sudo make install. This works because evildoers and assholes are too busy ruining lives of people using Windows, Android and iOS (and, increasingly, MacOS) to notice the small and tech-savvy Linux crowd.

flukus 8y ago
Most people install from the Ubuntu software centre or the distros equivalent which is vetted software, just like apples store. It's been that way since before there was an Apple app store. Even for power users configure and make is a last resort or something only developers will do for specific reasons. You have a strange idea of what desktop Linux is like.
- geofft 8y ago
  You don't think desktop Linux users use pip or npm? (Also, speaking as a distro packager, we don't do as much vetting as Apple does and we certainly don't do as much sandboxing. We're generally volunteers.)
  - glennpratt 8y ago
    So you've moved beyond the security on the mechanisms of software installation to just saying you trust Apple and don't trust open source software. That's all this boils down to.
  - flukus 8y ago
    > You don't think desktop Linux users use pip or npm? Most won't, only developers. Even there I'd say linux has an advantage because many of the dependencies in tools like that can be included by the distro itself. It hasn't worked well in practice so far but in theory it's a better solution. This is also identical across operating systems so it's hardly an example of one being superior to the other. > Also, speaking as a distro packager, we don't do as much vetting as Apple does and we certainly don't do as much sandboxing. I'm sure the vetting could be much stricter, but so far in practice it has not been an issue so I continue to trust responsible distros (debian, redhat, not arch). I'd also hope some distros like redhat are doing a lot more vetting.
glennpratt 8y ago
The middle of nowhere is not accurate. They have users, who are not experts, and attackers constantly. And they are much more vanilla Linux distro than I think you expect.