4 ms·

Linux. It has been "ready for the desktop" for more than a decade but it is not yet targeted by this type of malware. If it ends up being popular enough that wi

Linux. It has been "ready for the desktop" for more than a decade but it is not yet targeted by this type of malware. If it ends up being popular enough that will change but for now it is spared this disease. The advent of immutable distributions makes for a harder target for malware if and when this becomes a problem.

isthiseasymode 4y ago
I know I’ll ruffle some feathers on HN, but macOs is fine and probably the best OS for Mac (especially m1) hardware. No reason to make your life harder unless you’re doing it for your own enjoyment.
microtonal 4y ago
Most Linux distribution do still not have a properly verified boot chain, even something at the core of system boot like initrd is unsigned (which asks your LUKS password). There are immutable distributions, but they don't use sealed, cryptographically verified volumes. It is still trivial to modify the store in most immutable distributions to inject malware. User applications have no isolation at all, every app that parses untrusted input and does network access can read/write your whole home directory, including private keys, AWS credentials, etc. (most people don't use smartcards). Browsers only have some security because the browser developers have built their own sandboxes, but a determined actor can probably break it without too much issue through hardware acceleration APIs, etc. macOS as many times more secure than the Linux desktop. The only reason Linux is not a malwarefest is because the market share is so small that it is not that interesting. [1] https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/brave-new-trusted-boot-world.html
- aborsy 4y ago
  On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.
  - microtonal 4y ago
    Why do you believe governments don't have backdoors in the open source ecosystem? It's very easy to slip innocent looking bugs into open source projects with plausible deniability. See e.g. heartbleed or the Debian OpenSSL bug. Note that I am not claiming that these bugs are made by state actors. Just to show that it is easy to slip vulnerabilities in billions of lines of open source code that are used in a Linux desktop system. Heck, the FBI even tried to slip backdoors in OpenBSD which is only a marginal project in terms of high-value targets [1]. If any government has backdoors in macOS outside open source software in macOS, it is probably very limited (the US government if any, but Apple seems to resist most attempts at weakening security). [1] https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ https://arstechnica.com/information-technology/2010/12/fbi-a...
    - aborsy 4y ago
      It’s much easier to put in a backdoor, or actually implement a small monitoring system, in a closed source operating system. That’s much harder with open source software, not due to technical reasons, but because there is a good chance that eventually it will be discovered by some developer or security researcher. That will cause distrust of the government, and people going to defensive mode, making it much harder for governments to routinely hack into devices. So, for example, the discovery of the flaw in the Debian random number generator had a huge impact. People who design security systems really pay attention to PRNGs nowadays (to the point that it seems weak PRNGs are no longer a significant concern in the mainstream desktop operating systems, though the issue obviously remains in IoT, virtual machines, HSMs etc). Hiding the code for malware is common sense. That’s also why governments severely punish leaks these days.
      - gls2ro 4y ago
        I think your logic stands when thinking about individuals or private organisations. But when thinking about state actors they almost have unlimited money/resources thus even if adding a backdoor is a bit harder on open source having unlimited money/resources makes it irrelevant. Where “unlimited” = to the size of the open source organisation that maintains a bit of software.
tgv 4y ago
Linux for the desktop indeed has hardly progressed the last decade, and it sucks. Sure, gnome is more polished, but it's still a system for tinkerers. It's not user friendly and it's not a complete environment for end-users.

isthiseasymode 4y ago

I know I’ll ruffle some feathers on HN, but macOs is fine and probably the best OS for Mac (especially m1) hardware. No reason to make your life harder unless you’re doing it for your own enjoyment.

microtonal 4y ago

Most Linux distribution do still not have a properly verified boot chain, even something at the core of system boot like initrd is unsigned (which asks your LUKS password). There are immutable distributions, but they don't use sealed, cryptographically verified volumes. It is still trivial to modify the store in most immutable distributions to inject malware. User applications have no isolation at all, every app that parses untrusted input and does network access can read/write your whole home directory, including private keys, AWS credentials, etc. (most people don't use smartcards). Browsers only have some security because the browser developers have built their own sandboxes, but a determined actor can probably break it without too much issue through hardware acceleration APIs, etc. macOS as many times more secure than the Linux desktop. The only reason Linux is not a malwarefest is because the market share is so small that it is not that interesting. [1] https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/brave-new-trusted-boot-world.html

aborsy 4y ago
On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.
- microtonal 4y ago
  Why do you believe governments don't have backdoors in the open source ecosystem? It's very easy to slip innocent looking bugs into open source projects with plausible deniability. See e.g. heartbleed or the Debian OpenSSL bug. Note that I am not claiming that these bugs are made by state actors. Just to show that it is easy to slip vulnerabilities in billions of lines of open source code that are used in a Linux desktop system. Heck, the FBI even tried to slip backdoors in OpenBSD which is only a marginal project in terms of high-value targets [1]. If any government has backdoors in macOS outside open source software in macOS, it is probably very limited (the US government if any, but Apple seems to resist most attempts at weakening security). [1] https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ https://arstechnica.com/information-technology/2010/12/fbi-a...
  - aborsy 4y ago
    It’s much easier to put in a backdoor, or actually implement a small monitoring system, in a closed source operating system. That’s much harder with open source software, not due to technical reasons, but because there is a good chance that eventually it will be discovered by some developer or security researcher. That will cause distrust of the government, and people going to defensive mode, making it much harder for governments to routinely hack into devices. So, for example, the discovery of the flaw in the Debian random number generator had a huge impact. People who design security systems really pay attention to PRNGs nowadays (to the point that it seems weak PRNGs are no longer a significant concern in the mainstream desktop operating systems, though the issue obviously remains in IoT, virtual machines, HSMs etc). Hiding the code for malware is common sense. That’s also why governments severely punish leaks these days.
    - gls2ro 4y ago
      I think your logic stands when thinking about individuals or private organisations. But when thinking about state actors they almost have unlimited money/resources thus even if adding a backdoor is a bit harder on open source having unlimited money/resources makes it irrelevant. Where “unlimited” = to the size of the open source organisation that maintains a bit of software.

tgv 4y ago

Linux for the desktop indeed has hardly progressed the last decade, and it sucks. Sure, gnome is more polished, but it's still a system for tinkerers. It's not user friendly and it's not a complete environment for end-users.