5 ms·

>A new OS isn’t compelling for users. I'm a user (and in particular a Linux user) and a new OS which has Chromium ported to it is compelling to me because I ex

>A new OS isn’t compelling for users. I'm a user (and in particular a Linux user) and a new OS which has Chromium ported to it is compelling to me because I expect that Linux will never evolve to be secure enough.

kelnos 3y ago
Linux security (another desktop user here) is... fine? You can get pretty great security on it, if you want, by running Wayland instead of X11 and running all your apps via Flatpak or Snap (assuming you only choose apps that aren't intentionally allowed to break out of their sandbox). And none of these things require Linux (the kernel) to change all that much. Hell, Android has decent security by running all apps with different user IDs and restricting the parts of the filesystem it can access. Obviously your default Linux desktop install doesn't work like this, but some motivated individuals could do it, if they wanted. Writing an entire new OS is hardly necessary. Google just wanted something it could control, when it comes to Fuchsia. And they're the last company that I would trust to build an OS that doesn't end up being user-hostile.
- fbdab103 3y ago
  I think the world is destined to move to a microkernel OS eventually. I am just mad that there is not national level funding of sel4, which is audited and available today.
  - candiddevmike 3y ago
    Microkernels work great for virtualization guests, yet they aren't taking off in this kind of low friction environment. I don't think there's a killer app for them that justifies leaving behind Linux.
  - justapassenger 3y ago
    You can have secure monolith and insecure microkernel. It’s not a silver bullet, and security nowadays is really complicated.
    - LargeTomato 3y ago
      There are some technologies that are so good they can fix everything, almost as if by magic. Functional programming, micro kernels, RISC (or, depending on the decade, CISC), cryptocurrency, etc.
      - abrookewood 3y ago
        cryptocurrency has fixed nothing.
        prmoustache 3y ago
        Your sarcasm detector is broken.
    - saithound 3y ago
      > You can have secure monolith and insecure microkernel. Superficially, that claim sounds reasonable, but I'd have a hard time substantiating it. There is exactly one secure microkernel ready for production use today, and zero secure monolithic kernels. There's not even a "here's how one could secure a monolithic kernel in principle" whitepaper.
      - yjftsjthsd-h 3y ago
        > There is exactly one secure microkernel ready for production use today, and zero secure monolithic kernels. I'd be interested to hear your definition of "secure", and why OpenBSD doesn't qualify.
        astrange 3y ago
        OpenBSD mostly operates on a hobbyist's idea of security, where they just make up attacks to defend against rather than being systematic or actually keeping up with the outside world. (https://isopenbsdsecu.re https://isopenbsdsecu.re) Although professional security people are also rather bad at this and like to eg stack multiple cool-looking mitigations even if they break each other. (https://siguza.github.io/PAN/ https://siguza.github.io/PAN/)
- Manouchehri 3y ago
  Android (well, the Pixel anyway) does a great job of isolating processes by using SELinux and seccomp. You can have processes running as root that are still completely isolated away from most of the system.
- lmm 3y ago
  Flatpak and Snap are an inherently bad model; they break stuff and fail to secure other stuff, and their design means this will always be a game of whack-a-mole. And even if you were to Flatpak/Snap-ify all your apps (really? Would you run e.g. Bash that way?), you'd still be left having to run a bloated kernel to support a bunch of cruft that you weren't using. Starting from scratch with a clean interface seems like a better approach. (Qubes, OTOH, is interesting; I see it as one possible path to the future)
  - yjftsjthsd-h 3y ago
    > you'd still be left having to run a bloated kernel to support a bunch of cruft that you weren't using Would you? Linux is, in fact, quite modular, and perfectly happy to not load things until asked to (often as a result of hardware being discovered or plugged in).
  - dale_glass 3y ago
    Why are they a bad model? Sandboxing is a much better approach to security than the Unix permissions model, which is nearly obsolete.
    - bluGill 3y ago
      There is more to them than sandboxes though. They also package everything, if there is a security problem in a common library you are vulnerable in each sandbox until it is updated so updates become a much larger hole. Sure the problem cannot escape the sandbox, but in the end i'm more concerned with my data in the sandbox.
      - dale_glass 3y ago
        Yeah, but that's because Linux doesn't have a stable ABI, and really everyone does that these days. Both Mac and Windows just dump a whole bunch of libraries into the install directory. I think on Flatpak you can update the base platform package and have the applications use that automatically, so there's that.
candiddevmike 3y ago
Secure for who, you or Google? What are the privacy implications of Google owning the entire stack?
- CameronNemo 3y ago
  Secure for whoever has the keys to the device.
hulitu 3y ago
Ha ? You think an OS which exfiltrates all your data is "secure" ?
o1y32 3y ago
Even if what you say makes sense, there are maybe around three people in the world who are interested in a new OS because of this reason, which is not really the "users" that people talk about.

kelnos 3y ago

Linux security (another desktop user here) is... fine? You can get pretty great security on it, if you want, by running Wayland instead of X11 and running all your apps via Flatpak or Snap (assuming you only choose apps that aren't intentionally allowed to break out of their sandbox). And none of these things require Linux (the kernel) to change all that much. Hell, Android has decent security by running all apps with different user IDs and restricting the parts of the filesystem it can access. Obviously your default Linux desktop install doesn't work like this, but some motivated individuals could do it, if they wanted. Writing an entire new OS is hardly necessary. Google just wanted something it could control, when it comes to Fuchsia. And they're the last company that I would trust to build an OS that doesn't end up being user-hostile.

fbdab103 3y ago
I think the world is destined to move to a microkernel OS eventually. I am just mad that there is not national level funding of sel4, which is audited and available today.
- candiddevmike 3y ago
  Microkernels work great for virtualization guests, yet they aren't taking off in this kind of low friction environment. I don't think there's a killer app for them that justifies leaving behind Linux.
- justapassenger 3y ago
  You can have secure monolith and insecure microkernel. It’s not a silver bullet, and security nowadays is really complicated.
  - LargeTomato 3y ago
    There are some technologies that are so good they can fix everything, almost as if by magic. Functional programming, micro kernels, RISC (or, depending on the decade, CISC), cryptocurrency, etc.
    - abrookewood 3y ago
      cryptocurrency has fixed nothing.
      - prmoustache 3y ago
        Your sarcasm detector is broken.
  - saithound 3y ago
    > You can have secure monolith and insecure microkernel. Superficially, that claim sounds reasonable, but I'd have a hard time substantiating it. There is exactly one secure microkernel ready for production use today, and zero secure monolithic kernels. There's not even a "here's how one could secure a monolithic kernel in principle" whitepaper.
    - yjftsjthsd-h 3y ago
      > There is exactly one secure microkernel ready for production use today, and zero secure monolithic kernels. I'd be interested to hear your definition of "secure", and why OpenBSD doesn't qualify.
      - astrange 3y ago
        OpenBSD mostly operates on a hobbyist's idea of security, where they just make up attacks to defend against rather than being systematic or actually keeping up with the outside world. (https://isopenbsdsecu.re https://isopenbsdsecu.re) Although professional security people are also rather bad at this and like to eg stack multiple cool-looking mitigations even if they break each other. (https://siguza.github.io/PAN/ https://siguza.github.io/PAN/)
Manouchehri 3y ago
Android (well, the Pixel anyway) does a great job of isolating processes by using SELinux and seccomp. You can have processes running as root that are still completely isolated away from most of the system.
lmm 3y ago
Flatpak and Snap are an inherently bad model; they break stuff and fail to secure other stuff, and their design means this will always be a game of whack-a-mole. And even if you were to Flatpak/Snap-ify all your apps (really? Would you run e.g. Bash that way?), you'd still be left having to run a bloated kernel to support a bunch of cruft that you weren't using. Starting from scratch with a clean interface seems like a better approach. (Qubes, OTOH, is interesting; I see it as one possible path to the future)
- yjftsjthsd-h 3y ago
  > you'd still be left having to run a bloated kernel to support a bunch of cruft that you weren't using Would you? Linux is, in fact, quite modular, and perfectly happy to not load things until asked to (often as a result of hardware being discovered or plugged in).
- dale_glass 3y ago
  Why are they a bad model? Sandboxing is a much better approach to security than the Unix permissions model, which is nearly obsolete.
  - bluGill 3y ago
    There is more to them than sandboxes though. They also package everything, if there is a security problem in a common library you are vulnerable in each sandbox until it is updated so updates become a much larger hole. Sure the problem cannot escape the sandbox, but in the end i'm more concerned with my data in the sandbox.
    - dale_glass 3y ago
      Yeah, but that's because Linux doesn't have a stable ABI, and really everyone does that these days. Both Mac and Windows just dump a whole bunch of libraries into the install directory. I think on Flatpak you can update the base platform package and have the applications use that automatically, so there's that.

candiddevmike 3y ago

Secure for who, you or Google? What are the privacy implications of Google owning the entire stack?

CameronNemo 3y ago
Secure for whoever has the keys to the device.

hulitu 3y ago

Ha ? You think an OS which exfiltrates all your data is "secure" ?

o1y32 3y ago

Even if what you say makes sense, there are maybe around three people in the world who are interested in a new OS because of this reason, which is not really the "users" that people talk about.