4 ms·

You are wrong about trusting Linux. Linux would badly need AV if it was a more popular desktop OS. Right now the user base is just too small to be a valuable t

You are wrong about trusting Linux. Linux would badly need AV if it was a more popular desktop OS. Right now the user base is just too small to be a valuable target. A regular Linux distro (without SELinux or some kind of application sandboxing and a hardened setup including NOEXEC home, forbidding ptrace, ...) is very susceptible to compromise. All it takes is somehow getting the system to execute one unprivileged shell script and your user is permanently hosed. An attacker can spy on everything, including other applications memory, unless they prevent it. Browsers are also easily compromised by just injecting a extension that can spy on everything. Also he lack of dynamic firewalls makes it hard to monitor/prevent unwanted network traffic. (which could often be easily circumvented, though)

mirimir 7y ago
Thanks. I do appreciate that there are vulnerabilities. So I work only in VMs. I do nothing on host machines except to run VMs, and keep the OS up to date. And I compartmentalize rigorously. Minimally in different VMs. When it matters more, in different host machines. And when it really matters, in different host machines on different LANs. Only text files cross important security boundaries. And machines that my ~anonymous personas use never see anything about my meatspace identity. This is, of course, just a hobby.
codedokode 7y ago
Yes, Linux distributions don't have protection against malicious software. If you downloaded thrid-party program and run it, it can read everything from your home directory, including cookies and browser history, it can inject itself into browser process, it can see everything you type. And if you decided to add third-party apt repository, for example, to use Node.JS or VS Code, you give permanent root access to the owner of repository. Also, some third-party .deb packages (for example, Slack) automatically add their repository and public key to apt sources list upon installation. For example, there is a third-party repository, that allows installing multiple versions of PHP in Debian. This repository replaces cryptographic libraries provided by Debian with its own ones (you can see those packages here: https://packages.sury.org/php/pool/main/o/openssl/ https://packages.sury.org/php/pool/main/o/openssl/ ) Also, in Linux unprivileged program, run under "nobody" account, can read all unique hardware identifiers like MAC address, HDD serial number etc.

mirimir 7y ago

Thanks. I do appreciate that there are vulnerabilities. So I work only in VMs. I do nothing on host machines except to run VMs, and keep the OS up to date. And I compartmentalize rigorously. Minimally in different VMs. When it matters more, in different host machines. And when it really matters, in different host machines on different LANs. Only text files cross important security boundaries. And machines that my ~anonymous personas use never see anything about my meatspace identity. This is, of course, just a hobby.

codedokode 7y ago

Yes, Linux distributions don't have protection against malicious software. If you downloaded thrid-party program and run it, it can read everything from your home directory, including cookies and browser history, it can inject itself into browser process, it can see everything you type. And if you decided to add third-party apt repository, for example, to use Node.JS or VS Code, you give permanent root access to the owner of repository. Also, some third-party .deb packages (for example, Slack) automatically add their repository and public key to apt sources list upon installation. For example, there is a third-party repository, that allows installing multiple versions of PHP in Debian. This repository replaces cryptographic libraries provided by Debian with its own ones (you can see those packages here: https://packages.sury.org/php/pool/main/o/openssl/ https://packages.sury.org/php/pool/main/o/openssl/ ) Also, in Linux unprivileged program, run under "nobody" account, can read all unique hardware identifiers like MAC address, HDD serial number etc.