4 ms·

> macOS have superior security compared to standard Linux/BSD distributions even at the software level What evidence do you have to state that claim? > includ

by p_ing 2y ago

> macOS have superior security compared to standard Linux/BSD distributions even at the software level What evidence do you have to state that claim? > including proper verified boot and exploit mitigations? If not, why? Any operating system with TPM and Secure Boot support has this, Windows, Linux, and FreeBSD is in the planning stages for Secure Boot. It sounds like you're unaware of the available security features that have been available for a significant amount of time on x86.

bigfatkitten 2y ago
There is a huge gap between what's available for Linux (ie the Android and ChromeOS boot systems), and what the mainstream Linux distributions actually implement. On the whole, the distros do a terrible job. If you can modify the initrd (which you can on all of them by default), it's game over. And that's just secure boot. Linux has no real equivalent to TCC, for example.
- nicecars 2y ago
  I agree. I haven't seen any Linux OS with proper security featuring dm-verity-based Secure Boot (except for documentation in Arch explaining how to implement it). Most distributions cannot be considered security-hardened by default. What do you think is causing this situation?
  - bigfatkitten 2y ago
    I assume lack of priority because it's boring, compared with the shiny features developers tend to care about. There's some promising work happening in Fedora land with unified kernel images, undoubtedly due to demand from Red Hat's corporate and government customers. https://fedoraproject.org/wiki/Changes/Unified_Kernel_Support_Phase_2 https://fedoraproject.org/wiki/Changes/Unified_Kernel_Suppor...
nicecars 2y ago
While Linux systems like ChromeOS and Android could be considered sufficiently hardened, mainstream distributions generally don't prioritize security, with developers simply creating what they prefer. They lack comprehensive security features like those found in macOS (e.g., SIP, XProtect, MRT, Gatekeeper and other multi-layered protection mechanisms). Secure Boot on most Linux distributions, except for a few that implement TPM-based Secure Boot like ChromeOS Flex and custom Linux builds, is merely intended for UEFI support and Windows dual-boot compatibility, rather than being a genuine mechanism for detecting OS image tampering.
- fsflover 2y ago
  Yet all these security features fail due to the insecure browser, Safari, not implementing site isolation. What exactly is your threat model?
  - nicecars 2y ago
    Safari actually implements Site Isolation. Process-per-tab isolation was introduced in Safari 15 in 2021, and site isolation features were further enhanced in Safari 16.4.
    - fsflover 2y ago
      This is false, https://news.ycombinator.com/item?id=42859836 https://news.ycombinator.com/item?id=42859836
- coastal73 2y ago
  > Secure Boot on most Linux distributions, except for a few that implement TPM-based Secure Boot like ChromeOS Flex and custom Linux builds, is merely intended for UEFI support and Windows dual-boot compatibility, rather than being a genuine mechanism for detecting OS image tampering. So basically Linux distros without DM-Verity and TPM support? Basically not boot chain verified? ChromeOS uses coreboot vboot and Flex may use secure boot, but I haven't seen a ChromiumOS fork signed to work with UEFI secure boot, or worse coreboot with vboot, while a Linux distro it's possible with secure boot (I'm not sure about vboot), but to secure it and the software to a similar level, I feel it would just become similar to ChromiumOS, because there's so much software on Linux that is not isolated. I think Flatpak has way too many permissive permissions that even allow access to home directory and system permissions by default. Android apps are better, albeit ChromiumOS doesn't have Android apps enabled, are built with memory safe Java/Kotlin, with denied by default permissions. QubesOS does isolate Linux applications better than ChromiumOS, but it's just because you can have multiple virtual machines to isolate each Linux application. AFAIK ChromiumOS just uses one virtual machine + container? It is technically possible to apply DM-Verity but I've only had experience setting it up via initramfs, I heard Android applies it directly from the kernel. Making DM-Verity work on a lot of distros would completely change the way traditional Linux works, and would ideally require something similar to Android and ChromeOS way of working by system updates, to apply those root images. (Or maybe remake a root image, but I want to reduce privilege as much as possible.) And not just that, traditional Linux out of the gate lets the end-user use root, or a privilege escalation software like sudo/doas, whereas Android/ChromeOS has no root access by default.

by p_ing 2y ago

bigfatkitten 2y ago

There is a huge gap between what's available for Linux (ie the Android and ChromeOS boot systems), and what the mainstream Linux distributions actually implement. On the whole, the distros do a terrible job. If you can modify the initrd (which you can on all of them by default), it's game over. And that's just secure boot. Linux has no real equivalent to TCC, for example.

nicecars 2y ago
I agree. I haven't seen any Linux OS with proper security featuring dm-verity-based Secure Boot (except for documentation in Arch explaining how to implement it). Most distributions cannot be considered security-hardened by default. What do you think is causing this situation?
- bigfatkitten 2y ago
  I assume lack of priority because it's boring, compared with the shiny features developers tend to care about. There's some promising work happening in Fedora land with unified kernel images, undoubtedly due to demand from Red Hat's corporate and government customers. https://fedoraproject.org/wiki/Changes/Unified_Kernel_Support_Phase_2 https://fedoraproject.org/wiki/Changes/Unified_Kernel_Suppor...

nicecars 2y ago

While Linux systems like ChromeOS and Android could be considered sufficiently hardened, mainstream distributions generally don't prioritize security, with developers simply creating what they prefer. They lack comprehensive security features like those found in macOS (e.g., SIP, XProtect, MRT, Gatekeeper and other multi-layered protection mechanisms). Secure Boot on most Linux distributions, except for a few that implement TPM-based Secure Boot like ChromeOS Flex and custom Linux builds, is merely intended for UEFI support and Windows dual-boot compatibility, rather than being a genuine mechanism for detecting OS image tampering.

fsflover 2y ago
Yet all these security features fail due to the insecure browser, Safari, not implementing site isolation. What exactly is your threat model?
- nicecars 2y ago
  Safari actually implements Site Isolation. Process-per-tab isolation was introduced in Safari 15 in 2021, and site isolation features were further enhanced in Safari 16.4.
  - fsflover 2y ago
    This is false, https://news.ycombinator.com/item?id=42859836 https://news.ycombinator.com/item?id=42859836
coastal73 2y ago
> Secure Boot on most Linux distributions, except for a few that implement TPM-based Secure Boot like ChromeOS Flex and custom Linux builds, is merely intended for UEFI support and Windows dual-boot compatibility, rather than being a genuine mechanism for detecting OS image tampering. So basically Linux distros without DM-Verity and TPM support? Basically not boot chain verified? ChromeOS uses coreboot vboot and Flex may use secure boot, but I haven't seen a ChromiumOS fork signed to work with UEFI secure boot, or worse coreboot with vboot, while a Linux distro it's possible with secure boot (I'm not sure about vboot), but to secure it and the software to a similar level, I feel it would just become similar to ChromiumOS, because there's so much software on Linux that is not isolated. I think Flatpak has way too many permissive permissions that even allow access to home directory and system permissions by default. Android apps are better, albeit ChromiumOS doesn't have Android apps enabled, are built with memory safe Java/Kotlin, with denied by default permissions. QubesOS does isolate Linux applications better than ChromiumOS, but it's just because you can have multiple virtual machines to isolate each Linux application. AFAIK ChromiumOS just uses one virtual machine + container? It is technically possible to apply DM-Verity but I've only had experience setting it up via initramfs, I heard Android applies it directly from the kernel. Making DM-Verity work on a lot of distros would completely change the way traditional Linux works, and would ideally require something similar to Android and ChromeOS way of working by system updates, to apply those root images. (Or maybe remake a root image, but I want to reduce privilege as much as possible.) And not just that, traditional Linux out of the gate lets the end-user use root, or a privilege escalation software like sudo/doas, whereas Android/ChromeOS has no root access by default.