3 ms·

Bios? I'm not sure I can ever be certain. For the rest, I run a pretty esoteric setup (compiled-from-source custom configured linux kernel with no binary blobs

Bios? I'm not sure I can ever be certain. For the rest, I run a pretty esoteric setup (compiled-from-source custom configured linux kernel with no binary blobs; all software compiled from source, with no exceptions; aggressive, burdonsome-to-me privilege separation; chroots and VMs for various degrees of potential threat; etc). I have no illusions that it is perfectly safe. What I am comfortable with is that, in order to compromise me, you would have to know a lot about what I run and how I run it. I believe that I would have to be nearly individually targeted to extract any useful data from my machine, and that I am not nearly a valuable enough target for anyone to do so. I think you would have to be a state-level actor or someone with similar capabilities to compromise me, and none of them would care enough. My security paranoia stems from extremely sensitive work I did as a lawyer long ago, but I am now so used to it that I carry on as a scientist, even though my current work is not nearly so sensitive (if at all). I give up a lot of convenience and some functionality to operate this way, so it is not for everyone. I am not an adversary to anyone, so outside state actors surely don't care about me. And my own government can just get a warrant and knock on my door, so they don't care about me either. Embedded device firmware besides the bios is probably my main vulnerability, but if you're successfully getting at me through my hard drives or mouse, then I was surely an incidental rather than actual target.

ulimn 4y ago
I'm genuinely curious: Do you check/audit the code you compile and run on your machine? Going with the assumption of "no": How is it then different than downloading a prebuilt version from an official source?
- luma 4y ago
  It feels like a cargo cult approach to the problem. "I'm safe because I compile from source" is an absurd statement when a million LoC is involved.
  - kube-system 4y ago
    The linux kernel is much more than a million LoC. Closer to 30 million.
    - ghostpepper 4y ago
      If anything I think this underscores the parent comment - open source is not inherently more secure than closed, it just adds another potential avenue (source code audit) to ensure security. If nobody actually audits the source, and the closed-source binary has had other types of testing done on it, it's likely that the closed source binary will be more secure.
      - kube-system 4y ago
        Yes, my comment was in support of its parent. If reading a million lines is hard, reading ~30 million is harder.
    - amarshall 4y ago
      Much of that is drivers that may be disabled if not needed for current hardware, narrowing the audit scope.
- checkyoursudo 4y ago
  I should say, I will run binaries on VMs and feel very little threat from doing so. The "with no exceptions" referred to the main host OS. I should have been more clear about that. To answer your questions, oh hell no; definitely I do not audit source code myself. Though I have rarely. I do it this way, and it is different enough for me, because someone could audit the source in theory. If someone did audit and found a security problem, then I could check to see if my source was also compromised. If I install binaries, then I might not ever be able to know if my binary was compromised. Maybe someday if reproducible builds are guaranteed to be bit-perfect, then I would use binaries from reputable sources, but that would only happen in the case where third parties are compiling from source and affirming the reproduction. In that case, why not just compile it myself? Developers who publish compromised source are going to get burned. Developers who publish compromised binaries are going to say, "omg we must have been compromised by someone else." Obviously it is possible for third-parties to compromise source, but I'll go with what I see as the lesser threat. If the cost of compiling was high, then that might make a difference. For me, the cost is negligible, which makes it a no-brainer for me.
- soheil 4y ago
  I think for hardware level code and things link bios the only way is to trust the manufacturer. You could also trust the manufacturer but if they are not large enough to have fully vetted and trusted vendors then you're back to square one. So I think only in this sense it says something about the high degree of security of devices made by Apple.
M5x7wI3CmbEem10 4y ago
How does one achieve such security? Are there guides you found helpful?
ultra_nick 4y ago
QubesOS may be less cumbersome if it works for your use case.

ulimn 4y ago

I'm genuinely curious: Do you check/audit the code you compile and run on your machine? Going with the assumption of "no": How is it then different than downloading a prebuilt version from an official source?

luma 4y ago
It feels like a cargo cult approach to the problem. "I'm safe because I compile from source" is an absurd statement when a million LoC is involved.
- kube-system 4y ago
  The linux kernel is much more than a million LoC. Closer to 30 million.
  - ghostpepper 4y ago
    If anything I think this underscores the parent comment - open source is not inherently more secure than closed, it just adds another potential avenue (source code audit) to ensure security. If nobody actually audits the source, and the closed-source binary has had other types of testing done on it, it's likely that the closed source binary will be more secure.
    - kube-system 4y ago
      Yes, my comment was in support of its parent. If reading a million lines is hard, reading ~30 million is harder.
  - amarshall 4y ago
    Much of that is drivers that may be disabled if not needed for current hardware, narrowing the audit scope.
checkyoursudo 4y ago
I should say, I will run binaries on VMs and feel very little threat from doing so. The "with no exceptions" referred to the main host OS. I should have been more clear about that. To answer your questions, oh hell no; definitely I do not audit source code myself. Though I have rarely. I do it this way, and it is different enough for me, because someone could audit the source in theory. If someone did audit and found a security problem, then I could check to see if my source was also compromised. If I install binaries, then I might not ever be able to know if my binary was compromised. Maybe someday if reproducible builds are guaranteed to be bit-perfect, then I would use binaries from reputable sources, but that would only happen in the case where third parties are compiling from source and affirming the reproduction. In that case, why not just compile it myself? Developers who publish compromised source are going to get burned. Developers who publish compromised binaries are going to say, "omg we must have been compromised by someone else." Obviously it is possible for third-parties to compromise source, but I'll go with what I see as the lesser threat. If the cost of compiling was high, then that might make a difference. For me, the cost is negligible, which makes it a no-brainer for me.
soheil 4y ago
I think for hardware level code and things link bios the only way is to trust the manufacturer. You could also trust the manufacturer but if they are not large enough to have fully vetted and trusted vendors then you're back to square one. So I think only in this sense it says something about the high degree of security of devices made by Apple.

M5x7wI3CmbEem10 4y ago

How does one achieve such security? Are there guides you found helpful?

ultra_nick 4y ago

QubesOS may be less cumbersome if it works for your use case.