3 ms·

They don't advertise, but they have the same issues, which should be dealt with. I don't think it's fine to just say "security doesn't concern us" in the year 2

They don't advertise, but they have the same issues, which should be dealt with. I don't think it's fine to just say "security doesn't concern us" in the year 2021.

yellowapple 6y ago
> They don't advertise, but they have the same issues, which should be dealt with. Which is possible, specifically by deferring to something like Firejail that can handle any application rather than expecting every application format to bake in its own subtly-different mechanism. That is: > I don't think it's fine to just say "security doesn't concern us" in the year 2021. That ain't what's being said. What these folks are actually saying is that security and packaging are separate concerns, and that said security should be enforced in one place in a way that's applicable to all programs, no matter their packaging.
- tremon 6y ago
  security should be enforced in one place in a way that's applicable to all programs, no matter their packaging. How do you do that without placing contraints on said packaging, though? Will you just blanket-restrict all packages to the strictest security measures? i.e. no network, no access to persistent storage, w^x on all pages? Or will you only provide token security because all features are useful to some apps, and you can't know beforehand what features the app actually needs?
  - yellowapple 6y ago
    > Will you just blanket-restrict all packages to the strictest security measures? Seems like a reasonable default to me. And indeed, that seems to be more or less exactly what Firejail does if it doesn't have a profile already for an application: https://firejail.wordpress.com/documentation-2/ https://firejail.wordpress.com/documentation-2/
michaelmrose 6y ago
There is no practical path to securing the user from software they have installed on their own machine at this point. People protect themselves from bad software by having users install software from a curated repo that contains Firefox the browser from Mozilla not $irefox the cryptocurrency miner.

They don't advertise, but they have the same issues, which should be dealt with. I don't think it's fine to just say "security doesn't concern us" in the year 2021.

yellowapple 6y ago

> They don't advertise, but they have the same issues, which should be dealt with. Which is possible, specifically by deferring to something like Firejail that can handle any application rather than expecting every application format to bake in its own subtly-different mechanism. That is: > I don't think it's fine to just say "security doesn't concern us" in the year 2021. That ain't what's being said. What these folks are actually saying is that security and packaging are separate concerns, and that said security should be enforced in one place in a way that's applicable to all programs, no matter their packaging.

tremon 6y ago
security should be enforced in one place in a way that's applicable to all programs, no matter their packaging. How do you do that without placing contraints on said packaging, though? Will you just blanket-restrict all packages to the strictest security measures? i.e. no network, no access to persistent storage, w^x on all pages? Or will you only provide token security because all features are useful to some apps, and you can't know beforehand what features the app actually needs?
- yellowapple 6y ago
  > Will you just blanket-restrict all packages to the strictest security measures? Seems like a reasonable default to me. And indeed, that seems to be more or less exactly what Firejail does if it doesn't have a profile already for an application: https://firejail.wordpress.com/documentation-2/ https://firejail.wordpress.com/documentation-2/

michaelmrose 6y ago

There is no practical path to securing the user from software they have installed on their own machine at this point. People protect themselves from bad software by having users install software from a curated repo that contains Firefox the browser from Mozilla not $irefox the cryptocurrency miner.