3 ms·

I don't care if you work in security - the fact is that I have to completely trust every application that I want to run on Linux, which is unacceptably bad, and

I don't care if you work in security - the fact is that I have to completely trust every application that I want to run on Linux, which is unacceptably bad, and "Simply not necessary for normal applications running on my local desktop" is factually false (unless you're using some "gotcha" convoluted definition of "normal"). A sanely-designed OS will provide either capabilities or sandboxing - the tech has been around for decades, and they're more needed than ever in the 21st century with its abundance of malware.

MattPalmer1086 4y ago
Well, each to his own I guess. I don't see the need for myself. Data is backed up, critical data is encrypted and I've never had a malware infection. I'm pretty careful. You can run something like Qubes if you want better isolation.
- throw10920 4y ago
  > Well, each to his own I guess. I don't see the need for myself. That's not an attitude that someone working in security would have. It doesn't matter if "critical data is encrypted" if a keylogger is present when you enter your password. It doesn't matter that you've "never had a malware infection" because millions of other people have. And it doesn't matter that you're "pretty careful" because one of the core tenets of information security is that people are imperfect and it's best to remove as much of the human element as possible. These are relatively basic facts that someone with a few years of experience would know. > You can run something like Qubes if you want better isolation. Qubes is sandboxing - but the thread topic is about sandboxing on Linux, and the need for it in OSes in general. Security should come built-in, not as something you use a special OS for.
  - MattPalmer1086 4y ago
    We are talking about different things. I was talking about my own reasons for not wanting snap on my desktop. You are talking about the need for better security on operating systems in general. Security is never an absolute, it's always a trade off between many different factors, such as usability, protection, and cost. You have to take a risk based approach. People who work in security have to do this on a daily basis. For myself, the sand-boxing trade off is not worth it on my own desktop. Everything I have tried has significantly interfered with being able to do what I need to. If we were talking about what was needed on a critical, internet-exposed system, my answer might be different. On the subject of what a good secure OS would look like, I studied capabilities extensively when I did my MSc in Info Sec. The E language and the EROS operating system were absolutely fascinating. Getting rid of ambient authority would be awesome. I have worked with people who worked on CHERI, which is also a really promising approach to use capabilities for better memory protection - and has the advantage that it can work with code not written for it. When something like that is available, I'll be one of the first people trying it out!

MattPalmer1086 4y ago

Well, each to his own I guess. I don't see the need for myself. Data is backed up, critical data is encrypted and I've never had a malware infection. I'm pretty careful. You can run something like Qubes if you want better isolation.

throw10920 4y ago
> Well, each to his own I guess. I don't see the need for myself. That's not an attitude that someone working in security would have. It doesn't matter if "critical data is encrypted" if a keylogger is present when you enter your password. It doesn't matter that you've "never had a malware infection" because millions of other people have. And it doesn't matter that you're "pretty careful" because one of the core tenets of information security is that people are imperfect and it's best to remove as much of the human element as possible. These are relatively basic facts that someone with a few years of experience would know. > You can run something like Qubes if you want better isolation. Qubes is sandboxing - but the thread topic is about sandboxing on Linux, and the need for it in OSes in general. Security should come built-in, not as something you use a special OS for.
- MattPalmer1086 4y ago
  We are talking about different things. I was talking about my own reasons for not wanting snap on my desktop. You are talking about the need for better security on operating systems in general. Security is never an absolute, it's always a trade off between many different factors, such as usability, protection, and cost. You have to take a risk based approach. People who work in security have to do this on a daily basis. For myself, the sand-boxing trade off is not worth it on my own desktop. Everything I have tried has significantly interfered with being able to do what I need to. If we were talking about what was needed on a critical, internet-exposed system, my answer might be different. On the subject of what a good secure OS would look like, I studied capabilities extensively when I did my MSc in Info Sec. The E language and the EROS operating system were absolutely fascinating. Getting rid of ambient authority would be awesome. I have worked with people who worked on CHERI, which is also a really promising approach to use capabilities for better memory protection - and has the advantage that it can work with code not written for it. When something like that is available, I'll be one of the first people trying it out!