3 ms·

>sandbox apps This is about drivers...

quotemstr 2y ago
1) drivers should be apps too (Redox and others (even macOS partially) get this right) 2) driver vulnerabilities are there regardless of user setup. Making a user click a UAC button doesn't make the vulnerability disappear
- cruffle_duffle 2y ago
  Drivers can be whatever but their effect is usually global not for a specific user or app. So when you update, say, a graphics driver you are updating a shared resource used by everything in the system. You can run that display driver in whatever security context you want be it “root” or its own constrained context but that doesn’t change the fact that other things in the system, running under their own security contexts, are feeding that driver stuff. And given there is generally only one display output, or sound output, or whatever, all things in the system have to use it for output, making it more privileged than the rest. Whatever security context a display driver runs in, that context by requirement has to be more privileged than whatever context your browser or a calculator app runs in. To make changes to that shared display driver, you need to cross some kind of security boundary and it would be nice to make sure the user is who they say they are, they are allowed to do the requested action and they are made aware of the change. Thus methods like UAC and sudo. I’m not sure how you can escape that. Removing sudo and UAC doesn’t change the fact that something wants to mess with a shared resource running with some kind of elevated privilege.
  - anthk 2y ago
    Check Hurd's daemons and Plan9/9front (and Hurd's) namespaces.
    - deleted 2y ago
      [deleted]
    - deleted 2y ago
      [deleted]
  - ruthmarx 2y ago
    > Thus methods like UAC and sudo. UAC and Sudo are pretty different when you actually compare their implementations and not just purpose. Sudo is just a text prompt, UAC's design includes an entire isolated desktop to ensure fake prompts and such can't happen.
- gosub100 2y ago
  I used to openly hate the UAC box but now I do recognize it as a low cost, high-return feature that interrupts people to force them to recognize that something serious is about to happen. It probably works fine for families and small businesses where it gives non-technical people and opportunity to back out of whatever they were doing, especially if they didn't realize or intend to change something.
- BSDobelix 2y ago
  >drivers should be apps too (Redox and others (even macOS partially) get this right) Man i stop here since you don't even know what a driver is, and no, nor Redox or macOS can do anything against a bad/hostile but signed driver. But you obviously don't know what drivers are (hint..communicating directly with hardware)
  - quotemstr 2y ago
    Have you ever heard of an IOMMU? Talking to hardware is not a god mode cheat code. It's long been feasible to limit a drive's access to hardware it's supposed to manage. Why should I let my NVMe driver talk to my NIC? It shouldn't even be able to see plaintext disk sectors! If you're going to make sweeping statements about others being incorrect, it would behoove you to become familiar with the material.
    - BSDobelix 2y ago
      [flagged]
      - quotemstr 2y ago
        You're clearly interested in operating systems. I hope you learn about them one day so you can contribute to one. You might want to start with, e.g. infiniband drivers, which somehow allow programs to communicate "directly" with hardware without having unlimited privilege. There's a lot more to OS design than a user/kernel dichotomy, and user mode can do more than you think.
        BSDobelix 2y ago
        >infiniband drivers, which somehow allow programs to communicate "directly" with hardware At least you understand what drivers do, like my printer-driver or GPU-Drivers
      - ruthmarx 2y ago
        > Hey i stop here, You should, because it's not a good look for you. You're clearly speaking from ignorance. OS research has progressed a lot from what you learned 20 years ago or whatever.

1) drivers should be apps too (Redox and others (even macOS partially) get this right) 2) driver vulnerabilities are there regardless of user setup. Making a user click a UAC button doesn't make the vulnerability disappear

cruffle_duffle 2y ago
Drivers can be whatever but their effect is usually global not for a specific user or app. So when you update, say, a graphics driver you are updating a shared resource used by everything in the system. You can run that display driver in whatever security context you want be it “root” or its own constrained context but that doesn’t change the fact that other things in the system, running under their own security contexts, are feeding that driver stuff. And given there is generally only one display output, or sound output, or whatever, all things in the system have to use it for output, making it more privileged than the rest. Whatever security context a display driver runs in, that context by requirement has to be more privileged than whatever context your browser or a calculator app runs in. To make changes to that shared display driver, you need to cross some kind of security boundary and it would be nice to make sure the user is who they say they are, they are allowed to do the requested action and they are made aware of the change. Thus methods like UAC and sudo. I’m not sure how you can escape that. Removing sudo and UAC doesn’t change the fact that something wants to mess with a shared resource running with some kind of elevated privilege.
- anthk 2y ago
  Check Hurd's daemons and Plan9/9front (and Hurd's) namespaces.
  - deleted 2y ago
    [deleted]
  - deleted 2y ago
    [deleted]
- ruthmarx 2y ago
  > Thus methods like UAC and sudo. UAC and Sudo are pretty different when you actually compare their implementations and not just purpose. Sudo is just a text prompt, UAC's design includes an entire isolated desktop to ensure fake prompts and such can't happen.
gosub100 2y ago
I used to openly hate the UAC box but now I do recognize it as a low cost, high-return feature that interrupts people to force them to recognize that something serious is about to happen. It probably works fine for families and small businesses where it gives non-technical people and opportunity to back out of whatever they were doing, especially if they didn't realize or intend to change something.
BSDobelix 2y ago
>drivers should be apps too (Redox and others (even macOS partially) get this right) Man i stop here since you don't even know what a driver is, and no, nor Redox or macOS can do anything against a bad/hostile but signed driver. But you obviously don't know what drivers are (hint..communicating directly with hardware)
- quotemstr 2y ago
  Have you ever heard of an IOMMU? Talking to hardware is not a god mode cheat code. It's long been feasible to limit a drive's access to hardware it's supposed to manage. Why should I let my NVMe driver talk to my NIC? It shouldn't even be able to see plaintext disk sectors! If you're going to make sweeping statements about others being incorrect, it would behoove you to become familiar with the material.
  - BSDobelix 2y ago
    [flagged]
    - quotemstr 2y ago
      You're clearly interested in operating systems. I hope you learn about them one day so you can contribute to one. You might want to start with, e.g. infiniband drivers, which somehow allow programs to communicate "directly" with hardware without having unlimited privilege. There's a lot more to OS design than a user/kernel dichotomy, and user mode can do more than you think.
      - BSDobelix 2y ago
        >infiniband drivers, which somehow allow programs to communicate "directly" with hardware At least you understand what drivers do, like my printer-driver or GPU-Drivers
    - ruthmarx 2y ago
      > Hey i stop here, You should, because it's not a good look for you. You're clearly speaking from ignorance. OS research has progressed a lot from what you learned 20 years ago or whatever.