4 ms·

Even on a single-user system, if an attacker can't elevate to root then at least you don't have to reinstall the whole computer from scratch. You can just wipe

Even on a single-user system, if an attacker can't elevate to root then at least you don't have to reinstall the whole computer from scratch. You can just wipe the home directory, log in to a fresh account, and start putting your digital life back together. If they get root, you can't trust anything on the system any more. You have to do 10x the work just to get to the point of having a system you can even start to use. (Do you have a bootable install ISO handy anywhere? Is it current?)

mschuster91 3y ago
> If they get root, you can't trust anything on the system any more. ... and that includes the firmware of all components involved.
walteweiss 3y ago
Not to argue, but the reinstalling part isn’t so difficult these days. I don’t have a current bootable ISO, but I have a bunch of old 8…16 Gb USB drives just for that. Also, there is Ventoy that makes it even easier. So making an installer is a trivial task these days. For me, it’s either downloading Arch Linux media, which is 400 MB or something. Or it’s downloading a Fedora installer, which is 3…4 Gb and takes minutes to do. If I go the Fedora way (which I would, if I need a working computer right away), it’ll take up to an hour to get back to work. I understand that for an average user that could be a serious issue, but if that user is managed by someone competent, it’s really the non-issue. The only thing that needs to be done is a proper backup system for the data of that user. Recently, I had a case with some distant friend whom I help with his computer. He needs just a ‘Word’ and a browser, so he uses Debian and LibreOffice. I haven’t paid him visits for years, so the Debian was 10 or even 9, while the current one is 12. He wanted to install something, and as the system was very obsolete, I insisted on updating it first. I did the proper way (from version to version), but at some point the installation just broke for no reason. I tried to fix it, but even the help of ChatGPT didn’t allow me to do the job quickly. So I just nuked everything on his ssd (his data was on a separate hdd), went all-in Fedora and went talking and drinking tea with him. I was surprised how easy the whole reinstatement was. I’m talking Linux, which is very easy when you know what you do. But macOS or Windows not that difficult these days, when all you need to do is to reinstall. Again, considering the data is saved separately. Preferably beforehand.
- DEADMINCE 3y ago
  Why not setup your system the way you like it and take regular Clonezilla snapshots, so you can just restore from a known good ISO with all your programs and settings?
  - walteweiss 3y ago
    Personally, I don’t know. Although, a friend of mine does exactly that with his Windows install. The first time he described this to me was like 15 years ago! I never went that way, maybe because I don’t need the exact same system most of the times. When I reinstall, that happens voluntarily these days. And I just reconsider what I need. But overall that’s a great idea.
- Karellen 3y ago
  You do make some good points, but... > For me, it’s either downloading Arch Linux media, which is 400 MB or something. ...that's fine, if you have a separate non-compromised computer handy to download the installer from. Which not everyone will. ...and, is the only software you use included in that default 400 MB base system? How much else do you have to install? Did you keep a list of the extra packages you used, or are you going to have to keep going back to `pacman -S ...` every 5 minutes for the first couple of hours as you run into that thing you use frequently suddenly not being there?
  - generalizations 3y ago
    Software installation is trivial on linux, and periodic re-installations aren't a bad idea anyway - seems like that should be extremely preferable to, as GP said, "boiling the frog of linux DRM". These seem like weird justifications IMO.
- vlovich123 3y ago
  How do you accurately reinstall Arch to the same operational point as before? I’ve wanted to reinstall but it feels like a large long tail to reinstall all the same applications and fix up all the config files to the right state that I want things (e.g. is there some way to list all the packages installed & feed it back during the installer?).
osmano807 3y ago
Maybe someone have NixOS configs with all the settings, generating live ISO based on those configs. So the matter is just generating/booting those ISOs and you have a clean system with your configs. Put in some impermanence, and you have a clear separation of irreplaceable user and OS data, and replaceable data. Regularly back up the irreplaceable data, boot the ISO and mount this data (or an assumed not compromised version), and you effectively have your system back.

mschuster91 3y ago

> If they get root, you can't trust anything on the system any more. ... and that includes the firmware of all components involved.

walteweiss 3y ago

Not to argue, but the reinstalling part isn’t so difficult these days. I don’t have a current bootable ISO, but I have a bunch of old 8…16 Gb USB drives just for that. Also, there is Ventoy that makes it even easier. So making an installer is a trivial task these days. For me, it’s either downloading Arch Linux media, which is 400 MB or something. Or it’s downloading a Fedora installer, which is 3…4 Gb and takes minutes to do. If I go the Fedora way (which I would, if I need a working computer right away), it’ll take up to an hour to get back to work. I understand that for an average user that could be a serious issue, but if that user is managed by someone competent, it’s really the non-issue. The only thing that needs to be done is a proper backup system for the data of that user. Recently, I had a case with some distant friend whom I help with his computer. He needs just a ‘Word’ and a browser, so he uses Debian and LibreOffice. I haven’t paid him visits for years, so the Debian was 10 or even 9, while the current one is 12. He wanted to install something, and as the system was very obsolete, I insisted on updating it first. I did the proper way (from version to version), but at some point the installation just broke for no reason. I tried to fix it, but even the help of ChatGPT didn’t allow me to do the job quickly. So I just nuked everything on his ssd (his data was on a separate hdd), went all-in Fedora and went talking and drinking tea with him. I was surprised how easy the whole reinstatement was. I’m talking Linux, which is very easy when you know what you do. But macOS or Windows not that difficult these days, when all you need to do is to reinstall. Again, considering the data is saved separately. Preferably beforehand.

DEADMINCE 3y ago
Why not setup your system the way you like it and take regular Clonezilla snapshots, so you can just restore from a known good ISO with all your programs and settings?
- walteweiss 3y ago
  Personally, I don’t know. Although, a friend of mine does exactly that with his Windows install. The first time he described this to me was like 15 years ago! I never went that way, maybe because I don’t need the exact same system most of the times. When I reinstall, that happens voluntarily these days. And I just reconsider what I need. But overall that’s a great idea.
Karellen 3y ago
You do make some good points, but... > For me, it’s either downloading Arch Linux media, which is 400 MB or something. ...that's fine, if you have a separate non-compromised computer handy to download the installer from. Which not everyone will. ...and, is the only software you use included in that default 400 MB base system? How much else do you have to install? Did you keep a list of the extra packages you used, or are you going to have to keep going back to `pacman -S ...` every 5 minutes for the first couple of hours as you run into that thing you use frequently suddenly not being there?
- generalizations 3y ago
  Software installation is trivial on linux, and periodic re-installations aren't a bad idea anyway - seems like that should be extremely preferable to, as GP said, "boiling the frog of linux DRM". These seem like weird justifications IMO.
vlovich123 3y ago
How do you accurately reinstall Arch to the same operational point as before? I’ve wanted to reinstall but it feels like a large long tail to reinstall all the same applications and fix up all the config files to the right state that I want things (e.g. is there some way to list all the packages installed & feed it back during the installer?).

osmano807 3y ago

Maybe someone have NixOS configs with all the settings, generating live ISO based on those configs. So the matter is just generating/booting those ISOs and you have a clean system with your configs. Put in some impermanence, and you have a clear separation of irreplaceable user and OS data, and replaceable data. Regularly back up the irreplaceable data, boot the ISO and mount this data (or an assumed not compromised version), and you effectively have your system back.