6 ms·

> rather behind in the foundations. It's a single user system with no real security I believe multi-user systems are actually an ancient, outdated rather than

> rather behind in the foundations. It's a single user system with no real security I believe multi-user systems are actually an ancient, outdated rather than a "modern" concept. It made sense when computers were huge, expensive and many users shared one even at work, let alone at home. Nowadays computers are almost never shared. Even when people used to have just one home PC per family (during pre-Win7 days) they mostly preferred to disable the sign-in screen and share the whole environment. Nowadays multi-user OS facilities definitely help to build security but they were not designed just for this. Modern security can be done better without an OS-level concept of a user.

mikepurvis 2y ago
Modern multi-user paradigms also have very weird ideas of what’s shared. Like, installing or updating software is the same permission tier as accessing another user’s documents, wtf?
- eddd-ddde 2y ago
  _Technically_ it doesn't have to be. Super user is super user. It can always access anyone's files. Allowing unrestricted access to super user essentially destroys any sense of security. You can very much allow only access to certain commands under super user, e.g. only allow users to run pacman. Of course now you are trusting that said commands won't leak the permissions. I agree that it's a mess. My personal and biggest issue is not even across user boundaries, but inside a single user. What do you mean my Firefox client can read my .ssh files???
  - mavhc 2y ago
    https://xkcd.com/1200/ https://xkcd.com/1200/
    - mikepurvis 2y ago
      I almost linked that in my ggp comment, but really I’m making the opposite argument as the comic. Either way you slice it, though, it’s clearly a huge disconnect between what is important to the human using a system vs what is important to the system itself, and the relative lengths gone to to protect those two sets of things.
    - ekianjo 2y ago
      it does not make much sense as you typically protect important online activity with 2FA
- tedunangst 2y ago
  Don't mind me, just updating the software you use to access your documents, nothing to see here, move along.
- wolrah 2y ago
  > Like, installing or updating software is the same permission tier as accessing another user’s documents, wtf? To some extent, yes. If I can install software of my own choosing on basically any normal desktop OS that will appear to other users of the system as "LibreOffice", "Firefox", etc. then I more or less have access to all their data. MacOS is starting to sandbox applications but not by a lot, and of course Windows Store sandboxed apps are more or less dead in the water.
  - pjmlp 2y ago
    Do not mix Windows Store (UWP) sandboxes, with Windows sandbox, which not only is pretty much alive, is making its way across Windows 11 updates since last year. Check "Windows 11 Security", "App Isolation", "Sandbox", "Standard User", "Pluton". https://github.com/dwizzzle/Presentations/blob/master/David%20Weston%20-%20Windows%2011%20Security%20by-default%20-%20Bluehat%20IL%202023.pdf https://github.com/dwizzzle/Presentations/blob/master/David%...
- remedan 2y ago
  To me, a "modern multi-user paradigm" is Nix with Home Manager. Where most of my software is installed in my user's environment and not on the system level. Thus, if there were another user on the same machine, we could each manage our own software and updates without affecting the other.
Elyra 2y ago
> Nowadays computers are almost never shared. I find it ironic that Google TV still does not have this feature, it is the one "computer" that people probably still share regularly. Sure you can login to multiple accounts and have different "profiles", but that just changes home screen recommendations, all the apps and their sessions are shared. So since I share it with a few roommates, we're constantly having to logout and in to our accounts in different apps to access our watch histories, our plex servers, etc. On the other hand, my android phone does multiple accounts perfectly, why can't it work the same way on the TV?
- KetoManx64 2y ago
  Just buy another Google TV and hook them up to a KVM switch.
pjmlp 2y ago
OS security always requires a concept of a user, unless you want to run all processes under the same identity.
- rvense 2y ago
  But if you're sandboxing and running all applications in a separate space, is it really correct to refer to it as "users" anymore?
  - jl6 2y ago
    3rd party apps are written (controlled) by other people, and you are effectively granting that 3rd party permission to run their code on your device, so the user concept isn’t that far off the mark. Since ~nobody reads the source code of 3rd party apps, security vetting is usually a matter of deciding to trust the app’s author, same as how you would trust anyone else that you give a user account to.
    - tech2 2y ago
      You grant them capabilities, a handle which permits access to a particular directory, one which allows network access (or possibly even further limited than that) etc. No user, just a series of object handles which permit them to perform the task and nothing more.
      - jl6 2y ago
        Sure, but capabilities and handles are technical terms of art below the level at which regular users need to understand. The idea that an app is another person using your computer is not a terrible abstraction in terms of helping people make sense of what's happening.
        josephg 2y ago
        Maybe. But they're a bad mental model for software developers because user based security is way more limited than what you can do with capabilities. And they're confusing for users, too. Signal isn't another "user" on my phone. Its still me. I just decide what capabilities I grant it on the day. "Yes, you can use location tracking for now - but only until later in the day."
dvdkon 2y ago
Today, the same OS core is used in phones, laptops, desktops and servers. Explicitly making it single-user means giving up on servers and parts of the market for the former three. You could make the case for removing the concept of users from the kernel and forcing the OS to write some security plugin. The OS could then have a tailored security mechanism for every usecase, but they'd probably end up including users anyway (for the people who do want them).
- rbanffy 2y ago
  One such case is company-issued phones. They require the company-provided apps to be isolated from any user-specific configuration, creating an effective multi-user system where user apps (such as Apple Music) run with different privileges (and network access) than, say, Teams or Outlook.
  - mavhc 2y ago
    Every app on your phone runs as a different user
  - josephg 2y ago
    I think this is a good idea anyway. I love how if I install some dodgy app on my phone, it can't access the private, stored data of other apps. It can't steal my google or facebook credentials. And it can't cryptolocker my filesystem. My desktop computers are designed with this old "user security" model that I don't use at all - since I'm the only user anyway. User security protects ... uh, the operating system I suppose, which I could reinstall in 20 minutes anyway. But we're missing a much more important security boundary - which is between one bad program and all my other stuff. Every program you run today on desktop is inexplicably executed with full permission over all of your private files, and, worse, it has full network access. Its an insanely terrible design. We /could/ retrofit the user security model to help us isolate applications. But personally I think it would be easier to just design and implement something good from scratch. (For the security people in the room, the threat model is a bad program, or single bad npm package gets pulled into a program you run. How do we limit the blast radius?)
repelsteeltje 2y ago
Having grown up with RISC OS, I never considered lack of multi user an omission. But the lack of process isolation (or simply: lack of processes) was a real head-ache. No memory protection or hardware access, rudimentary virtual memory "page mapping". Any tardy calls to Wimp_Poll() freezing the entire GUI. "Cooperative multitasking" also means it's still impossible to do something useful with more than 1 Raspberry Pi core. So: lacking in foundations, yes. But multi user, not so much.
- ajb 2y ago
  Fair. On reflection I agree with all the people that have pointed out that multiuser isn't that important. It was just, historically, the feature that made operating systems become serious about security, which is now essential for other reasons.
- nurettin 2y ago
  After the PC revolution, "User" became synonymous with roles. root, bin, mail, daemon, sshd, www-data are probably some of the users on your system.
msla 2y ago
Single-user means I have to trust everything I run. I mean, some of us here actually remember MS-DOS. It's not a huge secret to us.
justinclift 2y ago
> Nowadays computers are almost never shared. That doesn't seem very accurate, unless you're meaning strictly personal computers?
jbverschoor 2y ago
Multi user is getting replaced by virtualization / containerization. The layers are simply getting shuffled
- nxobject 2y ago
  I think pervasive process/app sandboxing – or at the very least proactively and aggressing limiting process capabilites a la OpenBSD pledge and unveil – is a key development as well that's over the horizon as well. (What's old is new again with virtualization: IBM took that approach to make time-sharing happen with CP/CMS on System/360 – then VM/370, then z/VM...)
indymike 2y ago
> I believe multi-user systems are actually an ancient, outdated rather than a "modern" concept. I thought that in the 80s, and even had the same experience with sharing the family PC. Then networking (and the internet) happened, and suddenly multiuser became quite useful again - even at home. > Modern security can be done better without an OS-level concept of a user. Perhaps, but I have yet to see a userless model that doesn't have issues on around administrative access control. Even dumb terminals had issues with this where students would change settings and then set the admin password on the terminal... As long as people use computers, users will be users...
ekianjo 2y ago
multi user support has other purposes. it means you can turn the OS into a server OS which can be shared across numerous accounts. lacking that capability means you dissociate a desktop OS from a server OS for no good reason.
wiz21c 2y ago
I share my desktop PC with my kids and wife (although, TBH, I use the PC 90% of the time and the rest of the family uses the remaining 10%). Although we use the PC one at a time, being able to each have his own environment does help. So multiuser is cool for me.

mikepurvis 2y ago

Modern multi-user paradigms also have very weird ideas of what’s shared. Like, installing or updating software is the same permission tier as accessing another user’s documents, wtf?

eddd-ddde 2y ago
_Technically_ it doesn't have to be. Super user is super user. It can always access anyone's files. Allowing unrestricted access to super user essentially destroys any sense of security. You can very much allow only access to certain commands under super user, e.g. only allow users to run pacman. Of course now you are trusting that said commands won't leak the permissions. I agree that it's a mess. My personal and biggest issue is not even across user boundaries, but inside a single user. What do you mean my Firefox client can read my .ssh files???
- mavhc 2y ago
  https://xkcd.com/1200/ https://xkcd.com/1200/
  - mikepurvis 2y ago
    I almost linked that in my ggp comment, but really I’m making the opposite argument as the comic. Either way you slice it, though, it’s clearly a huge disconnect between what is important to the human using a system vs what is important to the system itself, and the relative lengths gone to to protect those two sets of things.
  - ekianjo 2y ago
    it does not make much sense as you typically protect important online activity with 2FA
tedunangst 2y ago
Don't mind me, just updating the software you use to access your documents, nothing to see here, move along.
wolrah 2y ago
> Like, installing or updating software is the same permission tier as accessing another user’s documents, wtf? To some extent, yes. If I can install software of my own choosing on basically any normal desktop OS that will appear to other users of the system as "LibreOffice", "Firefox", etc. then I more or less have access to all their data. MacOS is starting to sandbox applications but not by a lot, and of course Windows Store sandboxed apps are more or less dead in the water.
- pjmlp 2y ago
  Do not mix Windows Store (UWP) sandboxes, with Windows sandbox, which not only is pretty much alive, is making its way across Windows 11 updates since last year. Check "Windows 11 Security", "App Isolation", "Sandbox", "Standard User", "Pluton". https://github.com/dwizzzle/Presentations/blob/master/David%20Weston%20-%20Windows%2011%20Security%20by-default%20-%20Bluehat%20IL%202023.pdf https://github.com/dwizzzle/Presentations/blob/master/David%...
remedan 2y ago
To me, a "modern multi-user paradigm" is Nix with Home Manager. Where most of my software is installed in my user's environment and not on the system level. Thus, if there were another user on the same machine, we could each manage our own software and updates without affecting the other.

Elyra 2y ago

> Nowadays computers are almost never shared. I find it ironic that Google TV still does not have this feature, it is the one "computer" that people probably still share regularly. Sure you can login to multiple accounts and have different "profiles", but that just changes home screen recommendations, all the apps and their sessions are shared. So since I share it with a few roommates, we're constantly having to logout and in to our accounts in different apps to access our watch histories, our plex servers, etc. On the other hand, my android phone does multiple accounts perfectly, why can't it work the same way on the TV?

KetoManx64 2y ago
Just buy another Google TV and hook them up to a KVM switch.

pjmlp 2y ago

OS security always requires a concept of a user, unless you want to run all processes under the same identity.

rvense 2y ago
But if you're sandboxing and running all applications in a separate space, is it really correct to refer to it as "users" anymore?
- jl6 2y ago
  3rd party apps are written (controlled) by other people, and you are effectively granting that 3rd party permission to run their code on your device, so the user concept isn’t that far off the mark. Since ~nobody reads the source code of 3rd party apps, security vetting is usually a matter of deciding to trust the app’s author, same as how you would trust anyone else that you give a user account to.
  - tech2 2y ago
    You grant them capabilities, a handle which permits access to a particular directory, one which allows network access (or possibly even further limited than that) etc. No user, just a series of object handles which permit them to perform the task and nothing more.
    - jl6 2y ago
      Sure, but capabilities and handles are technical terms of art below the level at which regular users need to understand. The idea that an app is another person using your computer is not a terrible abstraction in terms of helping people make sense of what's happening.
      - josephg 2y ago
        Maybe. But they're a bad mental model for software developers because user based security is way more limited than what you can do with capabilities. And they're confusing for users, too. Signal isn't another "user" on my phone. Its still me. I just decide what capabilities I grant it on the day. "Yes, you can use location tracking for now - but only until later in the day."

dvdkon 2y ago

Today, the same OS core is used in phones, laptops, desktops and servers. Explicitly making it single-user means giving up on servers and parts of the market for the former three. You could make the case for removing the concept of users from the kernel and forcing the OS to write some security plugin. The OS could then have a tailored security mechanism for every usecase, but they'd probably end up including users anyway (for the people who do want them).

rbanffy 2y ago
One such case is company-issued phones. They require the company-provided apps to be isolated from any user-specific configuration, creating an effective multi-user system where user apps (such as Apple Music) run with different privileges (and network access) than, say, Teams or Outlook.
- mavhc 2y ago
  Every app on your phone runs as a different user
- josephg 2y ago
  I think this is a good idea anyway. I love how if I install some dodgy app on my phone, it can't access the private, stored data of other apps. It can't steal my google or facebook credentials. And it can't cryptolocker my filesystem. My desktop computers are designed with this old "user security" model that I don't use at all - since I'm the only user anyway. User security protects ... uh, the operating system I suppose, which I could reinstall in 20 minutes anyway. But we're missing a much more important security boundary - which is between one bad program and all my other stuff. Every program you run today on desktop is inexplicably executed with full permission over all of your private files, and, worse, it has full network access. Its an insanely terrible design. We /could/ retrofit the user security model to help us isolate applications. But personally I think it would be easier to just design and implement something good from scratch. (For the security people in the room, the threat model is a bad program, or single bad npm package gets pulled into a program you run. How do we limit the blast radius?)

repelsteeltje 2y ago

Having grown up with RISC OS, I never considered lack of multi user an omission. But the lack of process isolation (or simply: lack of processes) was a real head-ache. No memory protection or hardware access, rudimentary virtual memory "page mapping". Any tardy calls to Wimp_Poll() freezing the entire GUI. "Cooperative multitasking" also means it's still impossible to do something useful with more than 1 Raspberry Pi core. So: lacking in foundations, yes. But multi user, not so much.

ajb 2y ago
Fair. On reflection I agree with all the people that have pointed out that multiuser isn't that important. It was just, historically, the feature that made operating systems become serious about security, which is now essential for other reasons.
nurettin 2y ago
After the PC revolution, "User" became synonymous with roles. root, bin, mail, daemon, sshd, www-data are probably some of the users on your system.

msla 2y ago

Single-user means I have to trust everything I run. I mean, some of us here actually remember MS-DOS. It's not a huge secret to us.

justinclift 2y ago

> Nowadays computers are almost never shared. That doesn't seem very accurate, unless you're meaning strictly personal computers?

jbverschoor 2y ago

Multi user is getting replaced by virtualization / containerization. The layers are simply getting shuffled

nxobject 2y ago
I think pervasive process/app sandboxing – or at the very least proactively and aggressing limiting process capabilites a la OpenBSD pledge and unveil – is a key development as well that's over the horizon as well. (What's old is new again with virtualization: IBM took that approach to make time-sharing happen with CP/CMS on System/360 – then VM/370, then z/VM...)

indymike 2y ago

> I believe multi-user systems are actually an ancient, outdated rather than a "modern" concept. I thought that in the 80s, and even had the same experience with sharing the family PC. Then networking (and the internet) happened, and suddenly multiuser became quite useful again - even at home. > Modern security can be done better without an OS-level concept of a user. Perhaps, but I have yet to see a userless model that doesn't have issues on around administrative access control. Even dumb terminals had issues with this where students would change settings and then set the admin password on the terminal... As long as people use computers, users will be users...

ekianjo 2y ago

multi user support has other purposes. it means you can turn the OS into a server OS which can be shared across numerous accounts. lacking that capability means you dissociate a desktop OS from a server OS for no good reason.

wiz21c 2y ago

I share my desktop PC with my kids and wife (although, TBH, I use the PC 90% of the time and the rest of the family uses the remaining 10%). Although we use the PC one at a time, being able to each have his own environment does help. So multiuser is cool for me.