5 ms·

Depends on the bad guy. Social engineering is the best way on desktops. And this is what I meant by assumptions, on windows I can tell you phishing and removabl

Depends on the bad guy. Social engineering is the best way on desktops. And this is what I meant by assumptions, on windows I can tell you phishing and removable drives are the easiest way. On Linux desktop it simply isn't targeted enough to be confident which attack vectors are common. But you're missing the point, there will always be vulnerabilities. Even if everything is written in Rust, logical vulns exist, default config issues will exist (mongodb and internet exposure for example) and even the smartest people can be phished. Even with a yubikey,if I can trick you into opening a link that will have you download and open a file that will execute code on your machine, I don't need your login because I have your session cookies and I can reverse tunnel traffic through your IP. And I may not even care about that, maybe I just want your ssh private key and I will be on my way.

pdonis 7y ago
> Social engineering is the best way on desktops. Nobody uses my Linux desktop/laptop computers but me, and I have no reason to tell anyone else anything about them, so I don't. So I'm not vulnerable to this attack vector. > if I can trick you into opening a link that will have you download and open a file that will execute code on your machine I never click on links unless I know their source. So I'm not vulnerable to this attack vector either. If all that is wrong with the desktop Linux security model is "some users do dumb things", then that's not fixable by any OS. And even with that said, Linux is much better at containing the damage from doing dumb things than, say, Windows.
- badrabbit 7y ago
  I guarantee you, you will fall for a clever phish. You can't outsmart a good spearphish. You are wrong when you think stupidity is the vuln, the vuln is basic human psychology. But even if you're right, it's not like Linux desktop is made only for people like you right? It wouldn't be "some people are dumb" it would be "almost all people are dumb" even if being dumb was the issue.
  - pdonis 7y ago
    > I guarantee you, you will fall for a clever phish. You can guarantee no such thing. Not getting caught by phishing just isn't that hard. It requires a little self-discipline, yes. So do most worthwhile things. > It wouldn't be "some people are dumb" it would be "almost all people are dumb" even if being dumb was the issue. That's still not an OS issue. No amount of clever programming will help if people are that determined to do something dumb.
    - staticassertion 7y ago
      You ever run a pip install? Maybe an apt-get install?
      - pdonis 7y ago
        > You ever run a pip install? On my regular desktop, not of anything that wasn't Python code I had written myself. In development containers, yes, sometimes I've installed third-party Python programs to test them (and of course in Python it's easy to read the source code since what you install is the source code), but that's isolated from my regular desktop. > Maybe an apt-get install? Never of anything that wasn't from my distro's signed package repository.
    - danieldk 7y ago
      That's still not an OS issue. No amount of clever programming will help if people are that determined to do something dumb. And yet, a malicious iOS cannot typically take over the OS, other applications, or exfiltrate data from other applications. Sure, someone's bank account can be fished. But systems like iOS show that it is possible to protect users against a large numbers of attacks. One of the goals of an OS is to provide meaningful isolation boundaries. This is why we have a separation between ring 0 and 3, isolation of process address spaces, a separation between UID 0 and UID > 0. There is no reason why we should not introduce new forms of isolation invented after the 70ies.
      - pdonis 7y ago

pdonis 7y ago

> Social engineering is the best way on desktops. Nobody uses my Linux desktop/laptop computers but me, and I have no reason to tell anyone else anything about them, so I don't. So I'm not vulnerable to this attack vector. > if I can trick you into opening a link that will have you download and open a file that will execute code on your machine I never click on links unless I know their source. So I'm not vulnerable to this attack vector either. If all that is wrong with the desktop Linux security model is "some users do dumb things", then that's not fixable by any OS. And even with that said, Linux is much better at containing the damage from doing dumb things than, say, Windows.

badrabbit 7y ago
I guarantee you, you will fall for a clever phish. You can't outsmart a good spearphish. You are wrong when you think stupidity is the vuln, the vuln is basic human psychology. But even if you're right, it's not like Linux desktop is made only for people like you right? It wouldn't be "some people are dumb" it would be "almost all people are dumb" even if being dumb was the issue.
- pdonis 7y ago
  > I guarantee you, you will fall for a clever phish. You can guarantee no such thing. Not getting caught by phishing just isn't that hard. It requires a little self-discipline, yes. So do most worthwhile things. > It wouldn't be "some people are dumb" it would be "almost all people are dumb" even if being dumb was the issue. That's still not an OS issue. No amount of clever programming will help if people are that determined to do something dumb.
  - staticassertion 7y ago
    You ever run a pip install? Maybe an apt-get install?
    - pdonis 7y ago
      > You ever run a pip install? On my regular desktop, not of anything that wasn't Python code I had written myself. In development containers, yes, sometimes I've installed third-party Python programs to test them (and of course in Python it's easy to read the source code since what you install is the source code), but that's isolated from my regular desktop. > Maybe an apt-get install? Never of anything that wasn't from my distro's signed package repository.
  - danieldk 7y ago
    That's still not an OS issue. No amount of clever programming will help if people are that determined to do something dumb. And yet, a malicious iOS cannot typically take over the OS, other applications, or exfiltrate data from other applications. Sure, someone's bank account can be fished. But systems like iOS show that it is possible to protect users against a large numbers of attacks. One of the goals of an OS is to provide meaningful isolation boundaries. This is why we have a separation between ring 0 and 3, isolation of process address spaces, a separation between UID 0 and UID > 0. There is no reason why we should not introduce new forms of isolation invented after the 70ies.
    - pdonis 7y ago