3 ms·

That anything is not completely secure is a truism. In what way? Compared to what? Linux is not as secure as some research-level operating systems, but that c

That anything is not completely secure is a truism. In what way? Compared to what? Linux is not as secure as some research-level operating systems, but that comparison is not very useful for most people. Among mainstream operating systems, Linux contains comparably few surprises. There's also the fact that, like with much of open source, when the developer's interest align with yours the tools get more effective. Contrary to what you read on the Internet, most actors in the Linux ecosystem take security seriously. That the article references Spengler and Micay says a lot. That's like referencing the UNIX Hater's Handbook. That handbook was mostly right, but also not very practical. But over time it has done more for unix than most other texts, because it was mostly read by unix developers. The situation with these guys is mostly the same. A lot of the ideas voiced by them has been the basis for new features, just not in the form they were made originally.

asylteltine 3y ago
Compared to Mac OS, Linux is hardly secure, at least without significant knowledge and customization that almost every user has no understanding of.
Veserv 3y ago
Compared to a standard economically motivated criminal hacking business that will certainly attack any commercial deployment (i.e. the default threat model). Security exists relative to your attackers, not compared to other security solutions. A cardboard box is a thousand times more resistant to penetration than a paper box, but neither is adequate to protect jewelry. For software security, a trivial amount of resources like a mere 3 FTEs and 1 elapsed year will almost certainly defeat any Linux deployment. It will also almost certainly defeat any Windows, Mac, BSD, VMWare, iOS, Android, or any other commercial OS deployment. But, just because everyone only knows how to make cardboard boxes does not make any of them secure. And again, even if everybody else only knows how to make paper boxes, it does not make the cardboard box adequate. This is the case even if nobody in the entire world can do it; a cardboard box does not meet the minimum specifications, period.
Xeamek 3y ago
You literally have a comparison in the article, which lists security features from both windows and Mac that improve safety in different ways, and that linux lacks equivalents of.
- xorcist 3y ago
  The article offers no such comparison. It says that MacOS has sandboxing these days. That's good, but it's not a comparison. The MacOS sandbox is really complex. It's a rule based system specified in XML, and an unknown portion of that complexity is in a kernel module. That's both more attack surface and more room for mistakes than for example Firejail, which the article in turn rules out for being too complex. That's not a comparison. Traditional Linux software runs with the right amount of privileges. But that's not a fair comparison. Linux is a server OS from the start, which Mac or Windows isn't. Chrome is one example that really takes advantage of all the sandboxing possibilities Linux has. The article notes this as an example of how ChromeOS (which is pretty standard, as Linux distributions go) has much better security (what does that even mean?). It all boils down to that standard Linux distributions allows the user to download and run unchecked binaries. Well, yes. But that's not more security, that's more like a difference in expectations. A modern desktop should allow for all applications to only access shared data with well defined protocols, but neither Mac nor Windows does that. One that does is Android (which is very much non-standard, as Linux distributions go). Feel free to use that and get your work done. Again, it's a matter of expectations.

asylteltine 3y ago

Compared to Mac OS, Linux is hardly secure, at least without significant knowledge and customization that almost every user has no understanding of.

Veserv 3y ago

Compared to a standard economically motivated criminal hacking business that will certainly attack any commercial deployment (i.e. the default threat model). Security exists relative to your attackers, not compared to other security solutions. A cardboard box is a thousand times more resistant to penetration than a paper box, but neither is adequate to protect jewelry. For software security, a trivial amount of resources like a mere 3 FTEs and 1 elapsed year will almost certainly defeat any Linux deployment. It will also almost certainly defeat any Windows, Mac, BSD, VMWare, iOS, Android, or any other commercial OS deployment. But, just because everyone only knows how to make cardboard boxes does not make any of them secure. And again, even if everybody else only knows how to make paper boxes, it does not make the cardboard box adequate. This is the case even if nobody in the entire world can do it; a cardboard box does not meet the minimum specifications, period.

Xeamek 3y ago

You literally have a comparison in the article, which lists security features from both windows and Mac that improve safety in different ways, and that linux lacks equivalents of.

xorcist 3y ago
The article offers no such comparison. It says that MacOS has sandboxing these days. That's good, but it's not a comparison. The MacOS sandbox is really complex. It's a rule based system specified in XML, and an unknown portion of that complexity is in a kernel module. That's both more attack surface and more room for mistakes than for example Firejail, which the article in turn rules out for being too complex. That's not a comparison. Traditional Linux software runs with the right amount of privileges. But that's not a fair comparison. Linux is a server OS from the start, which Mac or Windows isn't. Chrome is one example that really takes advantage of all the sandboxing possibilities Linux has. The article notes this as an example of how ChromeOS (which is pretty standard, as Linux distributions go) has much better security (what does that even mean?). It all boils down to that standard Linux distributions allows the user to download and run unchecked binaries. Well, yes. But that's not more security, that's more like a difference in expectations. A modern desktop should allow for all applications to only access shared data with well defined protocols, but neither Mac nor Windows does that. One that does is Android (which is very much non-standard, as Linux distributions go). Feel free to use that and get your work done. Again, it's a matter of expectations.