8 ms·

ChromeOS seems very interesting to me because it has managed to achieve a degree of security that no other desktop OS (Windows, macOS, and of course other deskt

by akyuu 3y ago

ChromeOS seems very interesting to me because it has managed to achieve a degree of security that no other desktop OS (Windows, macOS, and of course other desktop Linux, which are the least secure of the bunch) can even approach. It has been designed from the ground up to be secure: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/security/chromeos_security_whitepaper.md https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sec... - Verified boot backed by TPM. - System services are heavily sandboxed: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sandboxing.md https://chromium.googlesource.com/chromiumos/docs/+/HEAD/san... - New userspace is written in Rust: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/development_basics.md#Rust https://chromium.googlesource.com/chromiumos/docs/+/HEAD/dev... - Web pages loaded on Chrome have no access to the device's filesystem, nor to user files. - Android apps run inside a restricted container. - Linux apps run inside a VM, which leverages KVM and a custom Rust VM monitor. I think it'd be great if someone made a de-Googled fork of ChromeOS without all the Google telemetry and bloatware, because it'd be the perfect Linux distro for security-conscious individuals.

packetlost 3y ago
Yeah, ChromeOS is actually pretty good for nearly everyone. Perhaps most importantly, they're incredibly popular in schools right now and have been for a few years. Google has definitely been working towards a long play with shifting the younger generations mindshare towards ChromeOS and away from Windows for productivity. It's interesting because it does actually have some of the necessary holes punched through to allow for serious power/dev usage, but is also secure by default and as usable as the websites you go to.
- JohnFen 3y ago
  > ChromeOS is actually pretty good for nearly everyone. It's been a while since I've given it a try, but I dislike ChomeOS for the same reason that I dislike MacOS. They make me feel like I'm wearing a straightjacket and get in my way. And, of course, any OS that requires me to have an account on any other server is not fit for purpose (to me).
  - GauntletWizard 3y ago
    And you're absolutely right about that - But it's a great OS for devices that you don't own. Leaving aside the (frequent, ugly, and probably illegal) times that school districts require parents to purchase children chromeOS devices that get joined to the school's domain, it's a very common problem to want to have devices that are locked down according to organization policy. When you are giving a device you own to someone else to physically control, the ChromeOS Straight Jacket is a great tool. There's a distinct problem with it being the only tool around, though.
- autoexec 3y ago
  ChromeOS is actually "pretty good" for someone who only looks at websites like facebook and reads email. It's also extremely confining and spies on you which makes it unacceptable for a lot of people and it's a sin that students are often stuck with them.
- pjmlp 3y ago
  US Schools, they are almost unseen in the rest of the world.
bitslayer 3y ago
The article mentions Chrome OS Flex, which is a version that doesn't require the Google security chip so it runs on a regular Intel PC. That is "de-Googled" I suppose, though I am not sure about the security implications that you mention.
- jasonvorhe 3y ago
  Has been bought out by Google though and it's now part of their enterprise products to install ChromeOS on non-Chromebooks.
- fruitreunion1 3y ago
  De-googled as in not tied to a Google account and its web services. Look at something like ungoogled-chromium.
- surajrmal 3y ago
  You lose secure boot when using ChromeOS flex. It's also not "degoogled".
tjdetwiler 3y ago
FYI Android apps are also in a VM now. https://chromeos.dev/en/posts/making-android-more-secure-with-arcvm https://chromeos.dev/en/posts/making-android-more-secure-wit...
fruitreunion1 3y ago
The system design is unique and interesting. It's a shame that the user experience doesn't align with how I want to use my computer, so I'll keep using desktop Linux and implement a bit of sandboxing myself. For the average consumer it could probably replace Windows for a lot of use cases and improve security due to its strict locked down and hard to exploit nature.
hooverd 3y ago
Sadly ChromiumOS still requires Google. ChromeOS to me feels like an attempt to make laptops more like smartphones. The security is there to protect what's running on your machine from you than you from bad actors.
- fruitreunion1 3y ago
  I feel a bit similarly. I'm torn these having very cool and interesting security properties but this way of using computers, for a lack of a better description, is just not what I'm after.
asdigonationio 3y ago
A rock is also pretty hard to hack. The hard problem of security is giving the user the power of a general-purpose machine without exposing them to the risks. "Don't run your favorite software lol" is not a valid approach to security. ChromeOS remains totally unsuitable for even casual usage, let alone anything serious. Someone will, I'm sure, claim that the use of virtual machines is a solution. It isn't. The layers of virtualization in ChromeOS lead to atrocious performance, reliability, and functionality. I am not willing to tolerate half my programs living in a different universe from the other half, nor am I willing to tolerate uptime measured in hours.
- sangnoir 3y ago
  Secure, performant, execute any code - choose 2. You have to choose an edge on this triangle.
- fatfingerd 3y ago
  I'm not sure what you mean by uptime measured in hours, it seemed fine to me in the years where I used it.. It also provides all of the common computing including all of the browser debuggers, etc, the state of common computing might not be that impressive but that is Windows, OSX and Linux' fault. One could argue that anything you can't do on a ChromeOS machine (or an equivalent Firefox one if that project were more complete) without running a VM is proprietary garbage. The other Apps you will run will work on some percentage of machines, the device you use have incomplete drivers, the window environments they developed for were not worth standardizing such that a browser has to provide the standards layer.
jrm4 3y ago
How, pray tell, are you getting to "Desktop Linux, the least secure of the bunch?"
- akyuu 3y ago
  https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html https://privsec.dev/posts/linux/linux-insecurities/ https://privsec.dev/posts/linux/linux-insecurities/ https://bjornpagen.com/en_US/desktop%20linux%20is%20insecure https://bjornpagen.com/en_US/desktop%20linux%20is%20insecure
  - jrm4 3y ago
    This tells me imperfect, which, sure. It doesn't tell me "the worst of the bunch."
    - akyuu 3y ago
      Compared to the other desktop operating systems (Windows and macOS), it absolutely is. It might have other advantages, but security is not one of them, and users should be aware.
      - deleted 3y ago
        [deleted]
      - emkoemko 3y ago
        huh? Linux security is is soo annoying it won't let other apps spy on key strokes so no way to have push to talk or have OBS on a keybinding.... mean while on windows all apps are key loggers
      - JuanPosadas 3y ago
        This the first I'm hearing of this, you should respond more substantially than repeating the assertion that's specifically being questioned.
AussieWog93 3y ago
Is security an actual practical concern for desktop users savvy enough to know what a container is? The only people I know who've had any sort of malware infection at all in the last 15 years are the ones who download and install random .exe files from spam emails and pirated TV streaming sites.
hollerith 3y ago
>I think it'd be great if someone made a de-Googled fork of ChromeOS without all the Google telemetry and bloatware, because it'd be the perfect Linux distro for security-conscious individuals. Since such a thing is currently unavailable, I'm inclined to try running ChromeOS, then having a headless Linux box next to it in the hopes that my customizing the headless Linux box will satisfy my need to customize my software environment. For example, I'm inclined to try to keep most of my personal files on the headless Linux box.

by akyuu 3y ago

packetlost 3y ago

Yeah, ChromeOS is actually pretty good for nearly everyone. Perhaps most importantly, they're incredibly popular in schools right now and have been for a few years. Google has definitely been working towards a long play with shifting the younger generations mindshare towards ChromeOS and away from Windows for productivity. It's interesting because it does actually have some of the necessary holes punched through to allow for serious power/dev usage, but is also secure by default and as usable as the websites you go to.

JohnFen 3y ago
> ChromeOS is actually pretty good for nearly everyone. It's been a while since I've given it a try, but I dislike ChomeOS for the same reason that I dislike MacOS. They make me feel like I'm wearing a straightjacket and get in my way. And, of course, any OS that requires me to have an account on any other server is not fit for purpose (to me).
- GauntletWizard 3y ago
  And you're absolutely right about that - But it's a great OS for devices that you don't own. Leaving aside the (frequent, ugly, and probably illegal) times that school districts require parents to purchase children chromeOS devices that get joined to the school's domain, it's a very common problem to want to have devices that are locked down according to organization policy. When you are giving a device you own to someone else to physically control, the ChromeOS Straight Jacket is a great tool. There's a distinct problem with it being the only tool around, though.
autoexec 3y ago
ChromeOS is actually "pretty good" for someone who only looks at websites like facebook and reads email. It's also extremely confining and spies on you which makes it unacceptable for a lot of people and it's a sin that students are often stuck with them.
pjmlp 3y ago
US Schools, they are almost unseen in the rest of the world.

bitslayer 3y ago

The article mentions Chrome OS Flex, which is a version that doesn't require the Google security chip so it runs on a regular Intel PC. That is "de-Googled" I suppose, though I am not sure about the security implications that you mention.

jasonvorhe 3y ago
Has been bought out by Google though and it's now part of their enterprise products to install ChromeOS on non-Chromebooks.
fruitreunion1 3y ago
De-googled as in not tied to a Google account and its web services. Look at something like ungoogled-chromium.
surajrmal 3y ago
You lose secure boot when using ChromeOS flex. It's also not "degoogled".

tjdetwiler 3y ago

FYI Android apps are also in a VM now. https://chromeos.dev/en/posts/making-android-more-secure-with-arcvm https://chromeos.dev/en/posts/making-android-more-secure-wit...

fruitreunion1 3y ago

The system design is unique and interesting. It's a shame that the user experience doesn't align with how I want to use my computer, so I'll keep using desktop Linux and implement a bit of sandboxing myself. For the average consumer it could probably replace Windows for a lot of use cases and improve security due to its strict locked down and hard to exploit nature.

hooverd 3y ago

Sadly ChromiumOS still requires Google. ChromeOS to me feels like an attempt to make laptops more like smartphones. The security is there to protect what's running on your machine from you than you from bad actors.

fruitreunion1 3y ago
I feel a bit similarly. I'm torn these having very cool and interesting security properties but this way of using computers, for a lack of a better description, is just not what I'm after.

asdigonationio 3y ago

A rock is also pretty hard to hack. The hard problem of security is giving the user the power of a general-purpose machine without exposing them to the risks. "Don't run your favorite software lol" is not a valid approach to security. ChromeOS remains totally unsuitable for even casual usage, let alone anything serious. Someone will, I'm sure, claim that the use of virtual machines is a solution. It isn't. The layers of virtualization in ChromeOS lead to atrocious performance, reliability, and functionality. I am not willing to tolerate half my programs living in a different universe from the other half, nor am I willing to tolerate uptime measured in hours.

sangnoir 3y ago
Secure, performant, execute any code - choose 2. You have to choose an edge on this triangle.
fatfingerd 3y ago
I'm not sure what you mean by uptime measured in hours, it seemed fine to me in the years where I used it.. It also provides all of the common computing including all of the browser debuggers, etc, the state of common computing might not be that impressive but that is Windows, OSX and Linux' fault. One could argue that anything you can't do on a ChromeOS machine (or an equivalent Firefox one if that project were more complete) without running a VM is proprietary garbage. The other Apps you will run will work on some percentage of machines, the device you use have incomplete drivers, the window environments they developed for were not worth standardizing such that a browser has to provide the standards layer.

jrm4 3y ago

How, pray tell, are you getting to "Desktop Linux, the least secure of the bunch?"

akyuu 3y ago
https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html https://privsec.dev/posts/linux/linux-insecurities/ https://privsec.dev/posts/linux/linux-insecurities/ https://bjornpagen.com/en_US/desktop%20linux%20is%20insecure https://bjornpagen.com/en_US/desktop%20linux%20is%20insecure
- jrm4 3y ago
  This tells me imperfect, which, sure. It doesn't tell me "the worst of the bunch."
  - akyuu 3y ago
    Compared to the other desktop operating systems (Windows and macOS), it absolutely is. It might have other advantages, but security is not one of them, and users should be aware.
    - deleted 3y ago
      [deleted]
    - emkoemko 3y ago
      huh? Linux security is is soo annoying it won't let other apps spy on key strokes so no way to have push to talk or have OBS on a keybinding.... mean while on windows all apps are key loggers
    - JuanPosadas 3y ago
      This the first I'm hearing of this, you should respond more substantially than repeating the assertion that's specifically being questioned.

AussieWog93 3y ago

Is security an actual practical concern for desktop users savvy enough to know what a container is? The only people I know who've had any sort of malware infection at all in the last 15 years are the ones who download and install random .exe files from spam emails and pirated TV streaming sites.

hollerith 3y ago

>I think it'd be great if someone made a de-Googled fork of ChromeOS without all the Google telemetry and bloatware, because it'd be the perfect Linux distro for security-conscious individuals. Since such a thing is currently unavailable, I'm inclined to try running ChromeOS, then having a headless Linux box next to it in the hopes that my customizing the headless Linux box will satisfy my need to customize my software environment. For example, I'm inclined to try to keep most of my personal files on the headless Linux box.