4 ms·

That might be what RedHat wishes it to be and push for. Does not mean they're right and that it won't fail. Big opportunity for badly packaged crap and securit

by ldng 6y ago

That might be what RedHat wishes it to be and push for. Does not mean they're right and that it won't fail. Big opportunity for badly packaged crap and security nightmare.

esarbe 6y ago
Why? All these components -- polkit, dbus, wayland, pipewire -- allow for sandboxing of applications. Flatpak already makes use of that to isolate applications from the system. If anything it will reduce the security nightmare.
- alxlaz 6y ago
  There's a huge, huge chasm between allowing for sandboxing of applications and actually getting applications sandboxed. Flatpak can make use of that to isolate applications from the system but many (and I'm using that to account for recent changes -- last time I looked into it, it was most) applications on Flathub are packaged with full access to $HOME and/or the root filesystem. It's not just a matter of technical difficulty, but also a problem of getting users on board: lots of them look at Flathub and -- quite understandably -- wonder why you'd want to jump through fifty sandboxing hoops to sandbox applications like Gimp and VLC, whose developers they trust and for which they get sandboxed packages out of their distributions' repos. The obvious retort that this isn't aimed at applications like Gimp and VLC feels a bit unsubstantiated because... what applications is it actually aimed at, then? Closed-source, potentially malicious applications like... what, if Linux had a lot of those, "the year of Linux on the desktop" wouldn't be a joke. And why not just run those in a virtual machine, which is likely to be a lot harder to escape from and also means you get to keep a "normal" *nix system as a host. It's hard to get people on-board with sandboxing when most of them shrug and say they don't need it, and when -- if you squint a little -- it kindda turns out they're not entirely wrong, either.
  - acatsdream 6y ago
    There are a lot of closed source apps available for linux.
    - alxlaz 6y ago
      Don't I know it. On the other hand, see the part about "if there were enough of those" ;-).
  - alxlaz 6y ago
    (Editing period is done so: > for which they get sandboxed packages out of their distributions' repos s/sandboxed/signed)
  - dTal 6y ago
    To expand on this - only running trustworthy programs is a far superior approach to this threat model than trying to somehow contain the damage from malicious code running on your machine. Siloing programs so you can run random crap feels like keeping the interior doors in your house locked to slow the progress of home invaders, while leaving the front door wide open - it's the wrong security boundary and it inconveniences you more than the attackers. Meltdown should have been the nail in the coffin for this philosophy.
  - danieldk 6y ago
    why you'd want to jump through fifty sandboxing hoops to sandbox applications like Gimp and VLC, whose developers they trust and for which they get signed packages out of their distributions' repos To mitigate zero-day vulnerabilities in applications that parse external data (such as Gimp and VLC)? Trusting an application does not mean that it does not have vulnerabilities that can be exploited in the future.

by ldng 6y ago

That might be what RedHat wishes it to be and push for. Does not mean they're right and that it won't fail. Big opportunity for badly packaged crap and security nightmare.

esarbe 6y ago

Why? All these components -- polkit, dbus, wayland, pipewire -- allow for sandboxing of applications. Flatpak already makes use of that to isolate applications from the system. If anything it will reduce the security nightmare.

alxlaz 6y ago
There's a huge, huge chasm between allowing for sandboxing of applications and actually getting applications sandboxed. Flatpak can make use of that to isolate applications from the system but many (and I'm using that to account for recent changes -- last time I looked into it, it was most) applications on Flathub are packaged with full access to $HOME and/or the root filesystem. It's not just a matter of technical difficulty, but also a problem of getting users on board: lots of them look at Flathub and -- quite understandably -- wonder why you'd want to jump through fifty sandboxing hoops to sandbox applications like Gimp and VLC, whose developers they trust and for which they get sandboxed packages out of their distributions' repos. The obvious retort that this isn't aimed at applications like Gimp and VLC feels a bit unsubstantiated because... what applications is it actually aimed at, then? Closed-source, potentially malicious applications like... what, if Linux had a lot of those, "the year of Linux on the desktop" wouldn't be a joke. And why not just run those in a virtual machine, which is likely to be a lot harder to escape from and also means you get to keep a "normal" *nix system as a host. It's hard to get people on-board with sandboxing when most of them shrug and say they don't need it, and when -- if you squint a little -- it kindda turns out they're not entirely wrong, either.
- acatsdream 6y ago
  There are a lot of closed source apps available for linux.
  - alxlaz 6y ago
    Don't I know it. On the other hand, see the part about "if there were enough of those" ;-).
- alxlaz 6y ago
  (Editing period is done so: > for which they get sandboxed packages out of their distributions' repos s/sandboxed/signed)
- dTal 6y ago
  To expand on this - only running trustworthy programs is a far superior approach to this threat model than trying to somehow contain the damage from malicious code running on your machine. Siloing programs so you can run random crap feels like keeping the interior doors in your house locked to slow the progress of home invaders, while leaving the front door wide open - it's the wrong security boundary and it inconveniences you more than the attackers. Meltdown should have been the nail in the coffin for this philosophy.
- danieldk 6y ago
  why you'd want to jump through fifty sandboxing hoops to sandbox applications like Gimp and VLC, whose developers they trust and for which they get signed packages out of their distributions' repos To mitigate zero-day vulnerabilities in applications that parse external data (such as Gimp and VLC)? Trusting an application does not mean that it does not have vulnerabilities that can be exploited in the future.