5 ms·

All desktop OSes assume virtually all code that's run on them (natively) to be trusted. This is in contrast to the mobile security model (at least iOS), and arg

by _bxg1 7y ago

All desktop OSes assume virtually all code that's run on them (natively) to be trusted. This is in contrast to the mobile security model (at least iOS), and arguably the web, where all apps are assumed to be potentially-hostile. Apple is trying to back-port macOS to the more modern model but so far the efforts seem to mostly be clunky and futile. Windows has UWP and Linux has "Snap", which sandbox individual apps, but they aren't widely used (and of course any malicious app wouldn't use them). When installing anything on your desktop system, keep the above in mind. Never run anything you don't 100% trust. I do wonder if package managers actually make this problem worse. As another commenter pointed out, they encourage people to install random packages liberally. It's an interesting exception to the "Windows is insecure" trope.

TwoBit 7y ago
Windows 10 doesn't work the way you claim all desktop OSs do.
- _bxg1 7y ago
  Last I checked (I suppose this was in Windows 7), it's trivial to write a Windows desktop app that can directly control the mouse and keyboard input without even requiring admin permissions.
  - sebazzz 7y ago
    Yes which is very useful in videoconferencing. We don't want to run Microsoft Teams or Skype elevated. You won't be able to control elevated applications though. You're still on the other side of the watertight hatch.
    - danieldk 7y ago
      Yes which is very useful in videoconferencing. We don't want to run Microsoft Teams or Skype elevated. In macOS, applications do not have permission to capture the screen, control the mouse pointer, use the mic, use the camera, etc. But the user can choose to elevate the permission (similar to iOS).
      - jcelerier 7y ago
        which as an user infuriates me daily
    - comex 7y ago
      > You won't be able to control elevated applications though Which doesn't matter to an attacker if their target is the user's data and that data is all stored in non-elevated applications.
- gentleman11 7y ago
  I was surprised and alarmed when I learned my games, made with unity, have so much file system access. I didn’t test it too much but for some reason I just assumed there were more restrictions
zokier 7y ago
There is bigger difference than just security; in web/mobile app model the user data/state and the app are tightly coupled and in many cases inseparable. In contrast in traditional desktop model applications are mostly stateless and the data lives independently as files. Personally I'm kinda saddened to see the file centric model to fade away, but maybe the interoperability by default model it drove was always a pipe dream. But it was a beautiful dream nonetheless
zobzu 7y ago
Same model on Android. And yes, while the Linux kernel has a bunch of issues, glibc has a bunch of issues, etc. the app model as you pointed out is the major problem. Even if you use snapd and others, the apps aren't made to be able to ask the user for things like storage access and what not, making things difficult. Ex: "Darktable, an image editor, needs to import pictures from you /home/blah/Pictures directory". Well then it needs full read access to /home/blah really, for things to work. On Android and other similar OSes at the minimum it has it's own storage space, and asks for additional access - or goes through the specific call to get pictures from the pictures app.
- _bxg1 7y ago
  Yes, Android puts on some security theater to pretend it has the isolationist model, but in reality random apps can do things like draw content over each other at any time, without any special permissions.
  - BenjiWiebe 7y ago
    Actually, there is a setting per-app in Android to disable apps drawing over other apps. And at least on my phone, it defaults to not allowing apps to draw over each other.
pjmlp 7y ago
Since MSIX, Windows has brought UWP sandbox to Win32 as well. The upcoming Windows 10X sandboxes everything by default, including Win32 applications.
LockAndLol 7y ago
This is why I don't understand why devs think it's OK to advise installing by piping curl into a sudo shell. In what world is that acceptable security?

by _bxg1 7y ago

TwoBit 7y ago

Windows 10 doesn't work the way you claim all desktop OSs do.

_bxg1 7y ago
Last I checked (I suppose this was in Windows 7), it's trivial to write a Windows desktop app that can directly control the mouse and keyboard input without even requiring admin permissions.
- sebazzz 7y ago
  Yes which is very useful in videoconferencing. We don't want to run Microsoft Teams or Skype elevated. You won't be able to control elevated applications though. You're still on the other side of the watertight hatch.
  - danieldk 7y ago
    Yes which is very useful in videoconferencing. We don't want to run Microsoft Teams or Skype elevated. In macOS, applications do not have permission to capture the screen, control the mouse pointer, use the mic, use the camera, etc. But the user can choose to elevate the permission (similar to iOS).
    - jcelerier 7y ago
      which as an user infuriates me daily
  - comex 7y ago
    > You won't be able to control elevated applications though Which doesn't matter to an attacker if their target is the user's data and that data is all stored in non-elevated applications.
gentleman11 7y ago
I was surprised and alarmed when I learned my games, made with unity, have so much file system access. I didn’t test it too much but for some reason I just assumed there were more restrictions

zokier 7y ago

There is bigger difference than just security; in web/mobile app model the user data/state and the app are tightly coupled and in many cases inseparable. In contrast in traditional desktop model applications are mostly stateless and the data lives independently as files. Personally I'm kinda saddened to see the file centric model to fade away, but maybe the interoperability by default model it drove was always a pipe dream. But it was a beautiful dream nonetheless

zobzu 7y ago

Same model on Android. And yes, while the Linux kernel has a bunch of issues, glibc has a bunch of issues, etc. the app model as you pointed out is the major problem. Even if you use snapd and others, the apps aren't made to be able to ask the user for things like storage access and what not, making things difficult. Ex: "Darktable, an image editor, needs to import pictures from you /home/blah/Pictures directory". Well then it needs full read access to /home/blah really, for things to work. On Android and other similar OSes at the minimum it has it's own storage space, and asks for additional access - or goes through the specific call to get pictures from the pictures app.

_bxg1 7y ago
Yes, Android puts on some security theater to pretend it has the isolationist model, but in reality random apps can do things like draw content over each other at any time, without any special permissions.
- BenjiWiebe 7y ago
  Actually, there is a setting per-app in Android to disable apps drawing over other apps. And at least on my phone, it defaults to not allowing apps to draw over each other.

pjmlp 7y ago

Since MSIX, Windows has brought UWP sandbox to Win32 as well. The upcoming Windows 10X sandboxes everything by default, including Win32 applications.

LockAndLol 7y ago

This is why I don't understand why devs think it's OK to advise installing by piping curl into a sudo shell. In what world is that acceptable security?