3 ms·
This is why I begrudgingly had to build a separate PC for nothing but gaming. Furious that it is the only way to firewall the cowboy coding what-is-security dev
by 0cf8612b2e1e 4y ago
This is why I begrudgingly had to build a separate PC for nothing but gaming. Furious that it is the only way to firewall the cowboy coding what-is-security development practices of the industry.
- viraptor 4y agoWhy a separate PC rather than a separate boot drive?
- 0cf8612b2e1e 4y agoIf the drives live in the same host system, they should be mountable by the other OS. The untrusted gaming partition/drive could then manipulate the trusted one. In practice, that would require the malware to be specifically targeted to dual-booters (representing a tiny fraction of users). Much better to go after the millions of Windows gaming PCs that also host the entirely of someone’s digital life. Which is to say the physical separation likely buys me little real security, but it does make me feel better.
- scotty79 4y agoMaybe you could keep the secure partition encrypted?
- 0cf8612b2e1e 4y agoThe untrusted partition could ransomware encrypt my already encrypted drive. Again, talking low likelihood that dual booters are a worthwhile target. Much more available low hanging fruit.
- weberer 4y agoYou should be encrypting your secure drive so stuff like this doesn't happen. Also so burglars can't grab your physical disk, put it in their machine, and read all your files. When installing most distros, they give you a checkbox to enable LUKS. https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup
- viraptor 4y agoBitlocker is also the default on most w10 and all w11.
- Narishma 4y agoIIRC it was not available on Windows 10 Home, which I'd guess to be the largest install base. I don't know about Windows 11.
- viraptor 4y agoWin 10 and 11 Home still allows device encryption (https://www.windowscentral.com/how-enable-device-encryption-windows-10-home https://www.windowscentral.com/how-enable-device-encryption-...)
- Narishma 4y agoThat requires TPM v2 and UEFI. I guess that's why I've never seen it in any of the Windows machines I have access to.
- 0cf8612b2e1e 4y agoThe untrusted OS could ransomware encrypt the already-encrypted trusted one. The attacker is denied access to my SSH keys, but so am I. Fully willing to confess this feels an outsized threat model, but it is something. Going forward, this separation will allow me to undersize my next linux workstation which requires far more modest hardware if never running games.