4 ms·

It’s worth noting that desktop Linux has mostly missed this development

spoiler 4y ago
Not a security expert, so I could be wrong. I imagine stuff like AppArmor, Snap (or Craft? I forget) sandboxes, or Docker and LXCs help with this. Or do they not?
- smashed 4y ago
  That is exactly what snap is aiming for. Apps run in a sandbox and have no access to user files except through "portals", which are secure file pickers essentially.
- lfodofod 4y ago
  Yes, AppArmor and snap try to. Still worlds away from what Windows and OS X are doing, not to even mention mobile platforms.
  - franga2000 4y ago
    Linux with snap or flatpak is far closer to mobile than whatever isolation Windows and MacOS have. The difference is in how widely and well implemented it is (it's neither).
  - ElectricalUnion 4y ago
    > Still worlds away from what Windows Not really, it's a on-purpose contrived thing to attempt to deploy sandboxed apps on Windows. Developing a sandboxed app in Windows means deploying a correctly sandboxed Appx in Microsoft Store, and getting those (Appx deployed on Microsoft Store) correctly working is hell for any non-trivial application. On Linux, you can attempt (it's not garanteed to work) to sandbox anything you want. Whenever the sandbox even is able to conveniently defend what really matters to you (say, your private key files) is another matter.
kube-system 4y ago
Linux was ahead of the game for quite a while. Back in the day, most desktop OSes assumed a single user.
- lfodofod 4y ago
  Desktop linux still exists in a single user world today, excluding some exotic and super fragile setups you might see in .edu networks.
  - LarryMullins 4y ago
    I think he's referring to the time when desktop Linux was competing against the likes of Windows 98. At that time, it was common for household PCs to be multi-user because one computer was shared by several people in the house. But with Windows 98, there was no protection between users; anybody using the computer could read anybody else's files. Even if you didn't have an account on the computer, you could just press [cancel] at the login screen and have access to the computer. User accounts on Windows 98 were only for the convenience of having different desktop settings, there was no concept of files being owned by specific users. Linux was a lot different at that time, in that it actually had a concept of users owning files. If you wanted to access another user's files without their permission you had to jump through more hoops like booting into single user mode.
  - Ferret7446 4y ago
    single user == root only. While linux has a single user mode, it is rarely used. Certainly not everywhere "excluding some exotic and super fragile setups you might see in .edu networks"
hdjjhhvvhga 4y ago
What do you have in mind? I'm using terminal only and don't track desktop development. Whenever I have to run something I don't trust, I use another account or, if it demands elevated privileges, a virtual machine. I guess with desktop it's not much different?

Not a security expert, so I could be wrong. I imagine stuff like AppArmor, Snap (or Craft? I forget) sandboxes, or Docker and LXCs help with this. Or do they not?

smashed 4y ago
That is exactly what snap is aiming for. Apps run in a sandbox and have no access to user files except through "portals", which are secure file pickers essentially.
lfodofod 4y ago
Yes, AppArmor and snap try to. Still worlds away from what Windows and OS X are doing, not to even mention mobile platforms.
- franga2000 4y ago
  Linux with snap or flatpak is far closer to mobile than whatever isolation Windows and MacOS have. The difference is in how widely and well implemented it is (it's neither).
- ElectricalUnion 4y ago
  > Still worlds away from what Windows Not really, it's a on-purpose contrived thing to attempt to deploy sandboxed apps on Windows. Developing a sandboxed app in Windows means deploying a correctly sandboxed Appx in Microsoft Store, and getting those (Appx deployed on Microsoft Store) correctly working is hell for any non-trivial application. On Linux, you can attempt (it's not garanteed to work) to sandbox anything you want. Whenever the sandbox even is able to conveniently defend what really matters to you (say, your private key files) is another matter.

kube-system 4y ago

Linux was ahead of the game for quite a while. Back in the day, most desktop OSes assumed a single user.

lfodofod 4y ago
Desktop linux still exists in a single user world today, excluding some exotic and super fragile setups you might see in .edu networks.
- LarryMullins 4y ago
  I think he's referring to the time when desktop Linux was competing against the likes of Windows 98. At that time, it was common for household PCs to be multi-user because one computer was shared by several people in the house. But with Windows 98, there was no protection between users; anybody using the computer could read anybody else's files. Even if you didn't have an account on the computer, you could just press [cancel] at the login screen and have access to the computer. User accounts on Windows 98 were only for the convenience of having different desktop settings, there was no concept of files being owned by specific users. Linux was a lot different at that time, in that it actually had a concept of users owning files. If you wanted to access another user's files without their permission you had to jump through more hoops like booting into single user mode.
- Ferret7446 4y ago
  single user == root only. While linux has a single user mode, it is rarely used. Certainly not everywhere "excluding some exotic and super fragile setups you might see in .edu networks"

hdjjhhvvhga 4y ago

What do you have in mind? I'm using terminal only and don't track desktop development. Whenever I have to run something I don't trust, I use another account or, if it demands elevated privileges, a virtual machine. I guess with desktop it's not much different?