7 ms·

The PRISM revelations in particular made me realise that we can really only rely on Linux for security, since Apple, MS, Amazon and all the big tech companies a

The PRISM revelations in particular made me realise that we can really only rely on Linux for security, since Apple, MS, Amazon and all the big tech companies are onboard with cooperating with the NSA. If you've read the way eg the CIA installs snooping software on Macs and PC's, they hide the Mac version in your hidden EFI boot volume, even from the factory. It's enough to make you never trust them again.

neolog 6y ago
Security isn't the same as privacy. Linux desktop security is poor but its privacy can be okay.
- mcdevilkiller 6y ago
  Why us it poor? (Genuinely asking).
  - user-the-name 6y ago
    No real push to use sandboxing or to limit access to personal information. Any app you install can do anything it wants with all of your data.
    - fsflover 6y ago
      Can't you run apps on behalf of restricted users?
      - vaduz 6y ago
        Via CLI you can, but GUI apps connect to your X server session, and then the fun begins - any application you allow to connect can essentially capture your keyboard, mouse, clipboard and a ton of other fun things,as there is no sandboxing applied between them. It's inherent in the design of the X protocol. There are solutions that are intended to force the sandboxing by opening a new Xserver for every application, e.g. Firejail [0], but that comes with another set of interoperability problems. Wayland was supposed to address some of these concerns, but it will only do so for applications that natively talk wayland protocol, not the ones that connect through x-protocol via xwayland [0] https://firejail.wordpress.com/ https://firejail.wordpress.com/
        fsflover 6y ago
        I expected that Wayland isolates the applications by default, not just when they allow it. So you might be interested in Qubes OS, which provides a very strong isolation through virtualization.
        vaduz 6y ago
        XWayland is essentially a translation layer consisting of Xserver and Wayland client [0]. Therefore it has all the same problems a normal Xserver has, which they do acknowledge: > A Wayland compositor usually spawns only one Xwayland instance. This is because many X11 applications assume they can communicate with other X11 applications through the X server, and this requires a shared X server instance. This also means that Xwayland does not protect nor isolate X11 clients from each other, unless the Wayland compositor specifically chooses to break the X11 client intercommunications by spawning application specific Xwayland instances. X11 clients are naturally isolated from Wayland clients. I use QubesOS, but it comes with its own set of problems as well. [0] https://wayland.freedesktop.org/docs/html/ch05.html https://wayland.freedesktop.org/docs/html/ch05.html
        Joe_Cool 6y ago
        That does not sound different from what Windows does. By default all programs running under the same user can access all windows of other applications (except UAC elevated ones). It's a relic from when OLE and Clipboard in Windows 3 just was (very simplified) a pointer to RAM.
        vaduz 6y ago
        The only reason it is worse with X11 is that it is an inherently networked protocol, so the same statements also apply to any remote connections you might allow to your X server. It also makes it somewhat easier to capture Xkb / Xinput events purely through API, without need for any elevation or excessive polling of the devices ("it just works"). That includes any systems you might have SSHed into with X forwarding enabled, as it automatically extends the trust there. Yes, your ssh client might try to enable X SECURITY extension (which clamps acesss to just the current window), but it is disabled by default or bypassed anyway by the users as that extension is known to crash quite a few programs. Both are a product of their time when the prevailing approach was to trust the programs you run.
      - user-the-name 6y ago
        Not easily, no. Doing so is a big kludge, rather than being part of a system actually designed to offer useful security measures.
    - tremon 6y ago
      I know, it's amazing, isn't it? Just think of the amazing possibilities this new "general-purpose computing" could unlock!
      - user-the-name 6y ago
        Claiming that a lack of security is a feature, actually, is not a great strategy.
    - oauea 6y ago
      This definitely is a feature. You can use sandboxing if you want to. See kernel namespaces (used by Docker), Ubuntu's snaps, etc. But breaking almost all software by default just because some incompetent users keep choosing to install malware is not a great strategy.
      - sneak 6y ago
        It isn't the dichotomy you set it up to be. macOS solved this without "breaking almost all software by default" using per-app, per-directory permissions for the file system, over and above the decades-old POSIX file modes model. You're making excuses for the lack of security innovation on Linux workstations. They've fallen behind.
        oauea 6y ago
        To be frank, Mac is not a model I would want to follow. I am the sysadmin and owner of my machine, not Apple or some other organization. They have no business telling me what software I can and can't run, or what files that software can access.
        user-the-name 6y ago
        They do neither.
        oauea 6y ago
        They most definitely do, using their developer program. Look up Apple vs Epic for a case where they weaponized this.
        user-the-name 6y ago
        You can run any software you want on macOS. You can't publish any software you want on the App Store.
        6y ago
- fsflover 6y ago
  If it's important for you and Linux security is not enough for you, consider using Qubes OS.
simonh 6y ago
Factory installed CIA snoop software on Macs is news to me, especially bearing in mind most of the factories are in Taiwan. Where can I find out more? Also if the spyware is installed in firmware at the factory, how is Linux going to help you?
- novaRom 6y ago
  > especially bearing in mind most of the factories are in Taiwan Zyxel, Asus, and other manufacturers of networking devices (with backdoors of course) are also there. https://arstechnica.com/information-technology/2021/01/hackers-are-exploiting-a-backdoor-built-into-zyxel-devices-are-you-patched/ https://arstechnica.com/information-technology/2021/01/hacke...
  - simonh 6y ago
    OK, so some Taiwanese network device manufacturers have poor default account practices, news at 11:00. I'm not seeing the CIA connection. Devices like this are used by the government and military contractors as well, and as you can see such vulnerabilities are trivial to detect so you can't count on the opposition finding out about it and using it. This one was picked up days after the firmware release. The smoking gun would be government and military admins secretly being advised by the CIA to close these security loopholes, so the government is protected but everyone else isn't. IMHO that would get Snowdened almost immediately. There's no way they'd keep a lid on that, there would just be too many people involved. As with a lot of this conspiracy theory stuff, it only makes sense if you don't think about it too much. Once you actually start thinking through the consequences and practicalities, it doesn't hold together.
    - fsflover 6y ago
      > poor default account practices Understatement of the year. Secret account is exactly what people call "a backdoor".
      - deleted 6y ago
        [deleted]

neolog 6y ago

Security isn't the same as privacy. Linux desktop security is poor but its privacy can be okay.

mcdevilkiller 6y ago
Why us it poor? (Genuinely asking).
- user-the-name 6y ago
  No real push to use sandboxing or to limit access to personal information. Any app you install can do anything it wants with all of your data.
  - fsflover 6y ago
    Can't you run apps on behalf of restricted users?
    - vaduz 6y ago
      Via CLI you can, but GUI apps connect to your X server session, and then the fun begins - any application you allow to connect can essentially capture your keyboard, mouse, clipboard and a ton of other fun things,as there is no sandboxing applied between them. It's inherent in the design of the X protocol. There are solutions that are intended to force the sandboxing by opening a new Xserver for every application, e.g. Firejail [0], but that comes with another set of interoperability problems. Wayland was supposed to address some of these concerns, but it will only do so for applications that natively talk wayland protocol, not the ones that connect through x-protocol via xwayland [0] https://firejail.wordpress.com/ https://firejail.wordpress.com/
      - fsflover 6y ago
        I expected that Wayland isolates the applications by default, not just when they allow it. So you might be interested in Qubes OS, which provides a very strong isolation through virtualization.
        vaduz 6y ago
        XWayland is essentially a translation layer consisting of Xserver and Wayland client [0]. Therefore it has all the same problems a normal Xserver has, which they do acknowledge: > A Wayland compositor usually spawns only one Xwayland instance. This is because many X11 applications assume they can communicate with other X11 applications through the X server, and this requires a shared X server instance. This also means that Xwayland does not protect nor isolate X11 clients from each other, unless the Wayland compositor specifically chooses to break the X11 client intercommunications by spawning application specific Xwayland instances. X11 clients are naturally isolated from Wayland clients. I use QubesOS, but it comes with its own set of problems as well. [0] https://wayland.freedesktop.org/docs/html/ch05.html https://wayland.freedesktop.org/docs/html/ch05.html
        Joe_Cool 6y ago
        That does not sound different from what Windows does. By default all programs running under the same user can access all windows of other applications (except UAC elevated ones). It's a relic from when OLE and Clipboard in Windows 3 just was (very simplified) a pointer to RAM.
        vaduz 6y ago
        The only reason it is worse with X11 is that it is an inherently networked protocol, so the same statements also apply to any remote connections you might allow to your X server. It also makes it somewhat easier to capture Xkb / Xinput events purely through API, without need for any elevation or excessive polling of the devices ("it just works"). That includes any systems you might have SSHed into with X forwarding enabled, as it automatically extends the trust there. Yes, your ssh client might try to enable X SECURITY extension (which clamps acesss to just the current window), but it is disabled by default or bypassed anyway by the users as that extension is known to crash quite a few programs. Both are a product of their time when the prevailing approach was to trust the programs you run.
    - user-the-name 6y ago
      Not easily, no. Doing so is a big kludge, rather than being part of a system actually designed to offer useful security measures.
  - tremon 6y ago
    I know, it's amazing, isn't it? Just think of the amazing possibilities this new "general-purpose computing" could unlock!
    - user-the-name 6y ago
      Claiming that a lack of security is a feature, actually, is not a great strategy.
  - oauea 6y ago
    This definitely is a feature. You can use sandboxing if you want to. See kernel namespaces (used by Docker), Ubuntu's snaps, etc. But breaking almost all software by default just because some incompetent users keep choosing to install malware is not a great strategy.
    - sneak 6y ago
      It isn't the dichotomy you set it up to be. macOS solved this without "breaking almost all software by default" using per-app, per-directory permissions for the file system, over and above the decades-old POSIX file modes model. You're making excuses for the lack of security innovation on Linux workstations. They've fallen behind.
      - oauea 6y ago
        To be frank, Mac is not a model I would want to follow. I am the sysadmin and owner of my machine, not Apple or some other organization. They have no business telling me what software I can and can't run, or what files that software can access.
        user-the-name 6y ago
        They do neither.
        oauea 6y ago
        They most definitely do, using their developer program. Look up Apple vs Epic for a case where they weaponized this.
        user-the-name 6y ago
        You can run any software you want on macOS. You can't publish any software you want on the App Store.
        6y ago
fsflover 6y ago
If it's important for you and Linux security is not enough for you, consider using Qubes OS.

simonh 6y ago

Factory installed CIA snoop software on Macs is news to me, especially bearing in mind most of the factories are in Taiwan. Where can I find out more? Also if the spyware is installed in firmware at the factory, how is Linux going to help you?

novaRom 6y ago
> especially bearing in mind most of the factories are in Taiwan Zyxel, Asus, and other manufacturers of networking devices (with backdoors of course) are also there. https://arstechnica.com/information-technology/2021/01/hackers-are-exploiting-a-backdoor-built-into-zyxel-devices-are-you-patched/ https://arstechnica.com/information-technology/2021/01/hacke...
- simonh 6y ago
  OK, so some Taiwanese network device manufacturers have poor default account practices, news at 11:00. I'm not seeing the CIA connection. Devices like this are used by the government and military contractors as well, and as you can see such vulnerabilities are trivial to detect so you can't count on the opposition finding out about it and using it. This one was picked up days after the firmware release. The smoking gun would be government and military admins secretly being advised by the CIA to close these security loopholes, so the government is protected but everyone else isn't. IMHO that would get Snowdened almost immediately. There's no way they'd keep a lid on that, there would just be too many people involved. As with a lot of this conspiracy theory stuff, it only makes sense if you don't think about it too much. Once you actually start thinking through the consequences and practicalities, it doesn't hold together.
  - fsflover 6y ago
    > poor default account practices Understatement of the year. Secret account is exactly what people call "a backdoor".
    - deleted 6y ago
      [deleted]