2 ms·

In the face of advances in security and usability brought about under iOS/Android/MacOS and yes, Windows S, these complaints are frankly ridiculous. The days of

In the face of advances in security and usability brought about under iOS/Android/MacOS and yes, Windows S, these complaints are frankly ridiculous. The days of running applications without confinement, that run with the full permissions of the user, are gone. Ubuntu might have been able to make this a smoother process, but they lack the literal BILLIONS of dollars that has been spent achieving that on other operating systems. If you want to be an old greybeard, use apt or build it from source.

throwawayishai 6y ago
Most snaps and flatpaks run with full home access. snaps only provide sandboxing when run with the Ubuntu AppArmor policy. snaps offer zero security without special configuration on other distros. Sandboxing desktop applications on Linux won't happen until distros start shipping strict SELinux policies that properly confine programs like Android does. Along with flatpak/systemd taking allowlisting seriously combined with stricter seccomp filters. Please if you maintain any packages with systemd units go read this right now and harden them, it should only take a few minutes: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing https://www.freedesktop.org/software/systemd/man/systemd.exe... Verify them using 'systemd-analyze security $unit'.
mixmastamyk 6y ago
> but they lack the literal BILLIONS of dollars that has been spent achieving that on other operating systems. They could have just stepped aside and used one of the alternatives—priceless. Not to mention it doesn't cost billions to develop a read-only chroot archive, the building blocks are available to combine. Just have to have the humility to choose the most elegant design, which already exist.
- angry_octet 6y ago
  Just use the Red Hat tool chain for everything? How does that end up? Subject to the whims of a few guys. Red Hat itself is better from having to compete. The use of 'just a chroot' thinking brings all the problems and none of the gains.

throwawayishai 6y ago

Most snaps and flatpaks run with full home access. snaps only provide sandboxing when run with the Ubuntu AppArmor policy. snaps offer zero security without special configuration on other distros. Sandboxing desktop applications on Linux won't happen until distros start shipping strict SELinux policies that properly confine programs like Android does. Along with flatpak/systemd taking allowlisting seriously combined with stricter seccomp filters. Please if you maintain any packages with systemd units go read this right now and harden them, it should only take a few minutes: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing https://www.freedesktop.org/software/systemd/man/systemd.exe... Verify them using 'systemd-analyze security $unit'.

mixmastamyk 6y ago

> but they lack the literal BILLIONS of dollars that has been spent achieving that on other operating systems. They could have just stepped aside and used one of the alternatives—priceless. Not to mention it doesn't cost billions to develop a read-only chroot archive, the building blocks are available to combine. Just have to have the humility to choose the most elegant design, which already exist.

angry_octet 6y ago
Just use the Red Hat tool chain for everything? How does that end up? Subject to the whims of a few guys. Red Hat itself is better from having to compete. The use of 'just a chroot' thinking brings all the problems and none of the gains.