4 ms·
This breaks the security benefits of Chromebooks. One of the advantages of Chromebooks is that hackers can't persuade naive users to download and run binaries.
by petilon 7y ago
This breaks the security benefits of Chromebooks. One of the advantages of Chromebooks is that hackers can't persuade naive users to download and run binaries.
Previously a company could issue Chromebooks to all employees and know that employees can't run arbitrary binaries on their Chromebooks.
- esrauch 7y agoPresumably they can still set that as a device policy.
- glenrivard 7y agoDoes not break security because of how Google implemented. It is also why MS has copied for WSL 2.
- 0xCMP 7y agoIt's all sandboxed and I'm sure they can disable the feature being there to increase security
- mav3rick 7y agoIt runs in a VM for precisely this reason. Look into the design docs and see how every piece is further locked down using minijail.
- rptr_87 7y agoDocument links: https://www.chromium.org/chromium-os/chromiumos-design-docs/security-overview https://www.chromium.org/chromium-os/chromiumos-design-docs/... https://www.chromium.org/chromium-os/chromiumos-design-docs/system-hardening https://www.chromium.org/chromium-os/chromiumos-design-docs/...
- carlosdp 7y agoI don't think it does. Linux is run in an isolated VM and debian is run in a container exposed to the user. The only filesystem interactions between ChromeOS and Linux are via Fuse and can only be transferred between environments from the ChromeOS side.
- cbolton 7y agoCompanies can disable the support for Linux apps, and the security measures taken to isolate Linux apps from Chrome OS are excellent (Linux apps are running in an unprivileged container inside a VM that has a stripped down kernel). There's definitely an increased attack surface inside the VM, but that's kind of unavoidable if you want to have a development environment (what this is marketed for). At least Chrome OS offers a secure way to isolate your development environment from your email/banking/etc processes.
- petilon 7y agoPreviously the CEO only had to ask, are all of my employees using ChromeBooks? Now he also has to ask, are those ChromeBooks all configured for security? It used to be a simple question, which could be answered at a glance. The new question is an order of magnitude harder to answer.
- cbolton 7y agoNot that hard since it's a simple switch by the administrator in the company device policy: https://support.google.com/chrome/a/answer/1375678?hl=en https://support.google.com/chrome/a/answer/1375678?hl=en (See "Virtual Machines") Such a step was already necessary to disable Android apps.
- chrisdfrey 7y agoDebian runs in a VM and different apps run in separate containers.
- peterwwillis 7y ago> hackers can't persuade naive users to download and run binaries. Hmm... Chrome Has a Malware Problem, and Google Needs to Fix It (https://www.tomsguide.com/us/chrome-extension-security-problems,news-26082.html https://www.tomsguide.com/us/chrome-extension-security-probl...) Chrome Extension Malware Has Evolved (https://www.wired.com/story/chrome-extension-malware/ https://www.wired.com/story/chrome-extension-malware/) How Malware Keeps Sneaking Past Google Play's Defenses (https://www.wired.com/story/google-play-store-malware/ https://www.wired.com/story/google-play-store-malware/) New Android Malware Infected 2 Million Google Play Store Users (https://thehackernews.com/2017/04/android-malware-playstore.html https://thehackernews.com/2017/04/android-malware-playstore....)
- Fice 7y agoUsers are not protected from malware distributed via Chrome Web Store and Google Play. This "security" is intended not to protect users, but to protect proprietary apps and data from users, the true motive is DRM rather than security.