5 ms·

> That is not a concern in the world that I or many people live in; the desktop is not expected to provide this type of Web browser-level isolation to provide p

> That is not a concern in the world that I or many people live in; the desktop is not expected to provide this type of Web browser-level isolation to provide protection from adversarial programs running on our machines. Increasingly, it is. Mobile OS's have operated under this assumption since the App Store. Windows and macOS are both strongly moving in this direction. Sandboxed apps are the future, and desktop Linux is behind. > The traditional packaging and distribution practices and social norms turn out to provide a much better line of defense than whatever technical design is being imported from other contemporary OSes. No, they don't. The thing you're trying to defend against is not just hostile apps, but someone remotely achieving RCE in one of your network-exposed applications. With X11, any compromised app has keys to the kingdom.

cxr 4y ago
> > That is not a concern in the world that I or many people live in[...] > Increasingly, it is. You haven't really done anything to show this. And as a point of fact, I'm in much better position to explain the concerns I live with than you are. Appealing yet again to what other platforms are doing is not an argument. Mac and Windows and Android are doing this. Fine. Granted. Where's your evidence of the actual, practical threat, besides merely gesturing to the (purported) imperative to follow their mitigation strategy? To repeat, this is just not a concern in the world that we're talking about—that other platforms/vendors have taken a different position is not evidence that their position is ipso facto rational and correct. > The thing you're trying to defend against is not just hostile apps, but someone remotely achieving RCE in one of your network-exposed applications. I'm not. I'm far more concerned, actually, about the threat from programs and utilities that don't have GUIs, incl. programs that depend on third-party packages of dubious provenance, than I am concerned about the threat of desktop applications reaching across to interfere with each other and violating any (non-existent) expectation of isolation of the sort described here.
- kaba0 4y ago
  What would defend you from an npm install script adding a few lines to your bashrc file and starting a keylogger on each start with full network access? When would you realize it happening? What about a malicious build script (have you ever run anything from Arch’s AUR?), a PDF reader with a buffer overflow error exploited by a random PDF file you wanted to read or the like? EDIT: But this whole thing means that a normal CLI app also gets to read everything on your screen! It is not only desktop-to-desktop protection, X has no protection whatsoever.
  - cxr 4y ago
    What? Why is this a reply to my comment?
    - kaba0 4y ago
      I think it is quite obvious why I replied - I listed several potential ways your computer could be vulnerable.
      - cxr 4y ago
        Well, it wasn't obvious—hence the question. And it's still not obvious, even now. What does a "list of several potential ways your computer could be vulnerable"* have to do, specifically, with my comment? Where is the logical throughline? Do you understand my comment to contain an assertion that my computer is not vulnerable if I were to run an "npm install script adding a few lines to your bashrc"? (It doesn't. That's the entire basis for my remark that I'm far more concerned about things like that than the threat of programs monitoring/faking IO among GUI-based apps.) * ... which, to be clear, is not what your comment actually contains—it was rather a series of questions in non-sequitur
        kaba0 4y ago
        > It doesn't. That's the entire basis for my remark that I'm far more concerned about things like that than the threat of programs monitoring/faking IO among GUI-based apps... But there is no difference between a strictly CLI app and a GUI one. Even if you ran everything in a sandbox, under X they could still do every nefarious thing. It would be like sealing one hole of a broken bucket, while water will still leak out on the other ones. Without GUI sandboxing we can’t even start fixing the security question on Linux desktop.
        cxr 4y ago
        > It would be like sealing one hole of a broken bucket, while water will still leak out on the other ones. I think you've stumbled upon my point without realizing it...

cxr 4y ago

> > That is not a concern in the world that I or many people live in[...] > Increasingly, it is. You haven't really done anything to show this. And as a point of fact, I'm in much better position to explain the concerns I live with than you are. Appealing yet again to what other platforms are doing is not an argument. Mac and Windows and Android are doing this. Fine. Granted. Where's your evidence of the actual, practical threat, besides merely gesturing to the (purported) imperative to follow their mitigation strategy? To repeat, this is just not a concern in the world that we're talking about—that other platforms/vendors have taken a different position is not evidence that their position is ipso facto rational and correct. > The thing you're trying to defend against is not just hostile apps, but someone remotely achieving RCE in one of your network-exposed applications. I'm not. I'm far more concerned, actually, about the threat from programs and utilities that don't have GUIs, incl. programs that depend on third-party packages of dubious provenance, than I am concerned about the threat of desktop applications reaching across to interfere with each other and violating any (non-existent) expectation of isolation of the sort described here.

kaba0 4y ago
What would defend you from an npm install script adding a few lines to your bashrc file and starting a keylogger on each start with full network access? When would you realize it happening? What about a malicious build script (have you ever run anything from Arch’s AUR?), a PDF reader with a buffer overflow error exploited by a random PDF file you wanted to read or the like? EDIT: But this whole thing means that a normal CLI app also gets to read everything on your screen! It is not only desktop-to-desktop protection, X has no protection whatsoever.
- cxr 4y ago
  What? Why is this a reply to my comment?
  - kaba0 4y ago
    I think it is quite obvious why I replied - I listed several potential ways your computer could be vulnerable.
    - cxr 4y ago
      Well, it wasn't obvious—hence the question. And it's still not obvious, even now. What does a "list of several potential ways your computer could be vulnerable"* have to do, specifically, with my comment? Where is the logical throughline? Do you understand my comment to contain an assertion that my computer is not vulnerable if I were to run an "npm install script adding a few lines to your bashrc"? (It doesn't. That's the entire basis for my remark that I'm far more concerned about things like that than the threat of programs monitoring/faking IO among GUI-based apps.) * ... which, to be clear, is not what your comment actually contains—it was rather a series of questions in non-sequitur
      - kaba0 4y ago
        > It doesn't. That's the entire basis for my remark that I'm far more concerned about things like that than the threat of programs monitoring/faking IO among GUI-based apps... But there is no difference between a strictly CLI app and a GUI one. Even if you ran everything in a sandbox, under X they could still do every nefarious thing. It would be like sealing one hole of a broken bucket, while water will still leak out on the other ones. Without GUI sandboxing we can’t even start fixing the security question on Linux desktop.
        cxr 4y ago
        > It would be like sealing one hole of a broken bucket, while water will still leak out on the other ones. I think you've stumbled upon my point without realizing it...