6 ms·

Linux apps aren't infested with malware and tracking trojans though, if the threat doesn't exist then there's no reason to protect from it. With android collect

by flukus 8y ago

Linux apps aren't infested with malware and tracking trojans though, if the threat doesn't exist then there's no reason to protect from it. With android collecting this sort of data is it's very reason for existence.

skybrian 8y ago
We don't usually see widespread infections, but Linux malware does exist. Also, many apps do send telemetry by default, though there are usually instructions to disable it.
- flukus 8y ago
  Sure it exists, but it's not an infestation. Even then I'm not aware of it or telemetry enabled apps in any trusted sources like the debian repositories (if you're aware of any please let me know), they'll even disable it from organisations like Mozilla that don't care about privacy. The play store cannot reasonably be considered a trusted source. If your going to download stuff from random places, which is how most telemetry enabled apps end up on linux systems then no sandboxing will work anyway, it will simply be disabled as part of the installation process. It's not a technological problem, you can't fix it with technology.
  - skybrian 8y ago
    Yes, a Linux distro like Debian has some security advantages since they won't ship just any app. But relying on code review isn't the same as having sandboxing in the OS.
    - flukus 8y ago
      There's two successful systems I know of out in the real world, Linux distros that rely on code review and iOS that relies on code review and sand boxing. There's two failures, android that relies purely on sandboxing and windows, which was too gimped by sandboxing to take off. > But relying on code review It's not just code review, it's having a degree of seperation between the developer and the packager/authorizer.
      - skybrian 8y ago
        Some things are more successful than others, but it's not a one-bit distinction. Arguing over whether to set the "success" bit would be silly. But it seems arbitrary to say that Android is a failure when it has more users than iOS or Linux. Browsers are another important example of sandboxing.
        flukus 8y ago
        > But it seems arbitrary to say that Android is a failure when it has more users than iOS or Linux. I'm not saying android is a failure, I'm saying it's sandboxing has not prevented malware and spyware being ubiquitous. This was a problem way back before android itself was a huge success. > Browsers are another important example of sandboxing. This has been pretty effective at preventing malware, but the web is a privacy nightmare and constantly getting worse.
        skybrian 8y ago
        Ok, I see what you mean. Caveats: Android doesn't rely solely on sandboxing. They also do automatic scanning and do often find stuff [1]. I also wouldn't say malware is so bad it's "ubiquitous" on Android since it's in the news quite often but I don't think the average user is likely to encounter it? My take on it is that current-generation sandboxes have permissions designed for security (preventing takeover by hackers), not privacy. In particular, preventing an app from phoning home isn't something they try to do. You can't have privacy without security so sandboxing is a prerequisite, though. [1] https://android-developers.googleblog.com/2019/02/how-we-fought-bad-apps-and-malicious.html https://android-developers.googleblog.com/2019/02/how-we-fou...
  - pjmlp 8y ago
    Of course not, given the failure of the year of desktop GNU/Linux, there is hardly any money to be made.
IshKebab 8y ago
That's just because few people use Linux, not because Linux has some inherent ability to stop people downloading malware. In fact it has less than any other major OS. Mobile OSes have vaguely curated app stores and proper permission systems. And Mac and Windows have at least attempted to help with their code signing systems (even if they are pointless and annoying). Linux has "run this `curl | exec` command as root".
- flukus 8y ago
  > Linux has "run this `curl | exec` command as root". You've clearly not used Linux much of you think that's the normal software installation method. That's the normal installation method on windows, minus the GUI to download and run for you. > That's just because few people use Linux, not because Linux has some inherent ability to stop people downloading malware You can't stop them downloading it, you have to direct them to trusted sources to get software, that's where Linux and iOS work, they have same approach but different implementations, it's where windows and Android fail. > Windows have at least attempted to help with their code signing systems Their best attempt so far is the windows store, but that was still born because they went for the sandboxing instead of verifying approach. > That's just because few people use Linux And all those servers aren't high value targets? We'd be seeing a lot more issues if "curl | Sudo exec" was how things were done.

by flukus 8y ago

skybrian 8y ago

We don't usually see widespread infections, but Linux malware does exist. Also, many apps do send telemetry by default, though there are usually instructions to disable it.

flukus 8y ago
Sure it exists, but it's not an infestation. Even then I'm not aware of it or telemetry enabled apps in any trusted sources like the debian repositories (if you're aware of any please let me know), they'll even disable it from organisations like Mozilla that don't care about privacy. The play store cannot reasonably be considered a trusted source. If your going to download stuff from random places, which is how most telemetry enabled apps end up on linux systems then no sandboxing will work anyway, it will simply be disabled as part of the installation process. It's not a technological problem, you can't fix it with technology.
- skybrian 8y ago
  Yes, a Linux distro like Debian has some security advantages since they won't ship just any app. But relying on code review isn't the same as having sandboxing in the OS.
  - flukus 8y ago
    There's two successful systems I know of out in the real world, Linux distros that rely on code review and iOS that relies on code review and sand boxing. There's two failures, android that relies purely on sandboxing and windows, which was too gimped by sandboxing to take off. > But relying on code review It's not just code review, it's having a degree of seperation between the developer and the packager/authorizer.
    - skybrian 8y ago
      Some things are more successful than others, but it's not a one-bit distinction. Arguing over whether to set the "success" bit would be silly. But it seems arbitrary to say that Android is a failure when it has more users than iOS or Linux. Browsers are another important example of sandboxing.
      - flukus 8y ago
        > But it seems arbitrary to say that Android is a failure when it has more users than iOS or Linux. I'm not saying android is a failure, I'm saying it's sandboxing has not prevented malware and spyware being ubiquitous. This was a problem way back before android itself was a huge success. > Browsers are another important example of sandboxing. This has been pretty effective at preventing malware, but the web is a privacy nightmare and constantly getting worse.
        skybrian 8y ago
        Ok, I see what you mean. Caveats: Android doesn't rely solely on sandboxing. They also do automatic scanning and do often find stuff [1]. I also wouldn't say malware is so bad it's "ubiquitous" on Android since it's in the news quite often but I don't think the average user is likely to encounter it? My take on it is that current-generation sandboxes have permissions designed for security (preventing takeover by hackers), not privacy. In particular, preventing an app from phoning home isn't something they try to do. You can't have privacy without security so sandboxing is a prerequisite, though. [1] https://android-developers.googleblog.com/2019/02/how-we-fought-bad-apps-and-malicious.html https://android-developers.googleblog.com/2019/02/how-we-fou...
- pjmlp 8y ago
  Of course not, given the failure of the year of desktop GNU/Linux, there is hardly any money to be made.

IshKebab 8y ago

That's just because few people use Linux, not because Linux has some inherent ability to stop people downloading malware. In fact it has less than any other major OS. Mobile OSes have vaguely curated app stores and proper permission systems. And Mac and Windows have at least attempted to help with their code signing systems (even if they are pointless and annoying). Linux has "run this `curl | exec` command as root".

flukus 8y ago
> Linux has "run this `curl | exec` command as root". You've clearly not used Linux much of you think that's the normal software installation method. That's the normal installation method on windows, minus the GUI to download and run for you. > That's just because few people use Linux, not because Linux has some inherent ability to stop people downloading malware You can't stop them downloading it, you have to direct them to trusted sources to get software, that's where Linux and iOS work, they have same approach but different implementations, it's where windows and Android fail. > Windows have at least attempted to help with their code signing systems Their best attempt so far is the windows store, but that was still born because they went for the sandboxing instead of verifying approach. > That's just because few people use Linux And all those servers aren't high value targets? We'd be seeing a lot more issues if "curl | Sudo exec" was how things were done.