5 ms·

I’m not sure it’s sensible to call these “protections” - they’re closer to security theater.

by centimeter 6y ago

xenocratus 6y ago
Can you give an example of what you consider proper protections?
- Craighead 6y ago
  Ever heard of crowdstrike?
- jhardy54 6y ago
  Full disk encryption?
  - spullara 6y ago
    Doesn't everyone have at enabled at this point?
    - jhardy54 6y ago
      No. There are tons of platforms that don't come with FDE by default (e.g. Raspberry Pi).
- heavyset_go 6y ago
  You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.
  - johncolanduoni 6y ago
    How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for it. X11 probably being the most egregious limiter, followed by no standard trusted file access UI. On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile.
    - danieldk 6y ago
      followed by no standard trusted file access UI. If an application uses Gtk+3 or Qt5 then portals will be used automatically for Open/Save dialogs: https://docs.flatpak.org/en/latest/sandbox-permissions.html#portals https://docs.flatpak.org/en/latest/sandbox-permissions.html#... I agree with the thrust of you comment though, outside the webbrowser, proper sandboxing a barely used outside web browsers. However, I think the problem is as much social as technical. Every time Flatpak comes up, it mostly gets hostile reactions. The situation is rather unfortunate. A lot of people believe that Linux is more secure than other operating systems, but in practice the Linux desktop is far less secure than e.g. macOS, iOS/iPadOS, or Android. And no, you aren't safe because it is open source software. Sandboxing also protects against unknown vulnerabilities in open source software.
    - merb 6y ago
      > On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile. actually firecracker is not a sandbox. it's basically qemu/libvirt and a minimal implementation of devices. it's qemu-kvm with a http interface and way less devices. the reason why they rewritten qemu-kvm is because qemu-kvm contains a lot of code that is not needed and is way more bug prone. and also loading a kernel is way faster in firecracker since they optimized the kernel loading code.

I’m not sure it’s sensible to call these “protections” - they’re closer to security theater.

xenocratus 6y ago

Can you give an example of what you consider proper protections?

Craighead 6y ago
Ever heard of crowdstrike?
jhardy54 6y ago
Full disk encryption?
- spullara 6y ago
  Doesn't everyone have at enabled at this point?
  - jhardy54 6y ago
    No. There are tons of platforms that don't come with FDE by default (e.g. Raspberry Pi).
heavyset_go 6y ago
You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.
- johncolanduoni 6y ago
  How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for it. X11 probably being the most egregious limiter, followed by no standard trusted file access UI. On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile.
  - danieldk 6y ago
    followed by no standard trusted file access UI. If an application uses Gtk+3 or Qt5 then portals will be used automatically for Open/Save dialogs: https://docs.flatpak.org/en/latest/sandbox-permissions.html#portals https://docs.flatpak.org/en/latest/sandbox-permissions.html#... I agree with the thrust of you comment though, outside the webbrowser, proper sandboxing a barely used outside web browsers. However, I think the problem is as much social as technical. Every time Flatpak comes up, it mostly gets hostile reactions. The situation is rather unfortunate. A lot of people believe that Linux is more secure than other operating systems, but in practice the Linux desktop is far less secure than e.g. macOS, iOS/iPadOS, or Android. And no, you aren't safe because it is open source software. Sandboxing also protects against unknown vulnerabilities in open source software.
  - merb 6y ago
    > On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile. actually firecracker is not a sandbox. it's basically qemu/libvirt and a minimal implementation of devices. it's qemu-kvm with a http interface and way less devices. the reason why they rewritten qemu-kvm is because qemu-kvm contains a lot of code that is not needed and is way more bug prone. and also loading a kernel is way faster in firecracker since they optimized the kernel loading code.