4 ms·

No threat model given. > Adds per-network MAC randomization Where the heck is this thing being used? > Setting more restrictive file permissions (Based on re

No threat model given. > Adds per-network MAC randomization Where the heck is this thing being used? > Setting more restrictive file permissions (Based on recommendations from lynis) Often results in more code being run privileged... > Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions Introduces a serious DoS vulnerability. > Disabling unprivileged user namespaces > Replacing bubblewrap with bubblewrap-suid so flatpak can be used without unprivileged user namespaces Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation. > Installing Chromium into the base image (Why chromium?) (Why not flatpak chromium?) Just more attack surface if you didn't remove Firefox. > Including a hardened chromium config (disabling JIT javascript) ... and pushing everybody into a less tested code path. Again, what is this trying to solve?

Alupis 3y ago
One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Security is always a trade off with convenience. Nobody will be installing this distro by accident, so your "who's this for? what is it trying to solve" is a bit misdirected. With that said - immutable is clearly the future for all operating systems, not just Linux Distros. It doesn't have much to do with security, although that is a side-effect. It mostly has to do with system stability, testability and repeatability. Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. After you setup your traditional machine, you install various drivers, updates, software, tweak some settings, remove some things - now your environment is unique to only you. This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Immutable solves that.
- Hizonner 3y ago
  > One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Maybe that's clear to you. > With that said - immutable is clearly the future for all operating systems, not just Linux Distros. Kind of a side issue. However... > Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. ... until you actually want to use it, at which point you're installing software in some kind of user account or application area, and you get to reexperience all the same problems and reinvent the solutions. Except with an extra layer of complexity to separate the "base image" from whatever you're actually trying to use the computer for. > This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Everyone's actual applications and needs are different.
  - Alupis 3y ago
    For everyday usage, like surfing the internet, word processing, emails, gaming, etc - these are all non-issues. Sandboxed app environments are easily accomplished today in various ways on Linux and other immutable OS (there's more than you think, including popular mobile operating systems). The base image never needs to change for any application to be installed and used. Layering is not even a requirement for almost all software to work as expected on an immutable system. Development is still weird on immutable OS's - since developers do weird things. Currently the solution is pet containers, which are more of a PITA than not, but it does work fine. With that said, modern development environments should not be sprawled all across your system anyway - that's bad for so many reasons. Regardless, if you would prefer to layer on top of the base os, then you still get the overwhelming majority of immutable benefits. Immutable is the future...
    - getwiththeprog 3y ago
      Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use. Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Linux is a feature, because every OS ever created has holes and flaws and lacks features. It is a nice idea that we could all be on the same system that works flawlessly, but it is not an achievable reality. So while immutable may be the future, it will always be in the future.
secureblue 3y ago
Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege Only bubblewrap would run as root, but yes this is a fair critique as this is an opinionated tradeoff. I'm considering adding a set of userns variants to give users the choice between the two. the packages have a bad security reputation By default we only enable the flathub-verified remote for this reason. Just more attack surface if you didn't remove Firefox. We're removing firefox. ... and pushing everybody into a less tested code path. Again, what is this trying to solve? Around half of V8 vulnerabilities are enabled by JIT: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
secureblue 3y ago
FYI, both userns and non-userns variants are now available. https://github.com/secureblue/secureblue/commit/38999d4123aa2e37e6ebcd365e19b9b99b0b7a7f https://github.com/secureblue/secureblue/commit/38999d4123aa...

Alupis 3y ago

One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Security is always a trade off with convenience. Nobody will be installing this distro by accident, so your "who's this for? what is it trying to solve" is a bit misdirected. With that said - immutable is clearly the future for all operating systems, not just Linux Distros. It doesn't have much to do with security, although that is a side-effect. It mostly has to do with system stability, testability and repeatability. Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. After you setup your traditional machine, you install various drivers, updates, software, tweak some settings, remove some things - now your environment is unique to only you. This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Immutable solves that.

Hizonner 3y ago
> One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Maybe that's clear to you. > With that said - immutable is clearly the future for all operating systems, not just Linux Distros. Kind of a side issue. However... > Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. ... until you actually want to use it, at which point you're installing software in some kind of user account or application area, and you get to reexperience all the same problems and reinvent the solutions. Except with an extra layer of complexity to separate the "base image" from whatever you're actually trying to use the computer for. > This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Everyone's actual applications and needs are different.
- Alupis 3y ago
  For everyday usage, like surfing the internet, word processing, emails, gaming, etc - these are all non-issues. Sandboxed app environments are easily accomplished today in various ways on Linux and other immutable OS (there's more than you think, including popular mobile operating systems). The base image never needs to change for any application to be installed and used. Layering is not even a requirement for almost all software to work as expected on an immutable system. Development is still weird on immutable OS's - since developers do weird things. Currently the solution is pet containers, which are more of a PITA than not, but it does work fine. With that said, modern development environments should not be sprawled all across your system anyway - that's bad for so many reasons. Regardless, if you would prefer to layer on top of the base os, then you still get the overwhelming majority of immutable benefits. Immutable is the future...
  - getwiththeprog 3y ago
    Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use. Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Linux is a feature, because every OS ever created has holes and flaws and lacks features. It is a nice idea that we could all be on the same system that works flawlessly, but it is not an achievable reality. So while immutable may be the future, it will always be in the future.

secureblue 3y ago

Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege Only bubblewrap would run as root, but yes this is a fair critique as this is an opinionated tradeoff. I'm considering adding a set of userns variants to give users the choice between the two. the packages have a bad security reputation By default we only enable the flathub-verified remote for this reason. Just more attack surface if you didn't remove Firefox. We're removing firefox. ... and pushing everybody into a less tested code path. Again, what is this trying to solve? Around half of V8 vulnerabilities are enabled by JIT: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

secureblue 3y ago

FYI, both userns and non-userns variants are now available. https://github.com/secureblue/secureblue/commit/38999d4123aa2e37e6ebcd365e19b9b99b0b7a7f https://github.com/secureblue/secureblue/commit/38999d4123aa...