14 ms·

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as wel

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

stavros 1y ago
If you think Linux is an experiment, you should see the other OSes.
- khurs 1y ago
  Including Openbsd?
- ahofmann 1y ago
  I'm pretty sure, that the BSD family is pretty mature and secure. Linux is just good enough for most people.
  - deleted 1y ago
    [deleted]
  - charcircuit 1y ago
    >is pretty mature and secure They are still missing something like capability based security like iOS and Android have where apps have to be granted access to use things like files or the camera. It may have been considered secure a couple decades ago, but they have fallen behind the competiton.
    - NexRebular 1y ago
      > They are still missing something like capability based security ...like Capsicum? https://wiki.freebsd.org/Capsicum https://wiki.freebsd.org/Capsicum
      - charcircuit 1y ago
        No, that requires explicit changes by programs to use meaning that malware can ignore it and steal your browser's cookies and take secret photos with your webcam.
        NexRebular 1y ago
        So the capability-based security framework is not missing unlike your original statement?
        charcircuit 1y ago
        My original statement is about how users have to explicitly give programs access to the files and the webcam before they can use them. This is missing.
    - 8fingerlouie 1y ago
      You can use Jails and limit access to hardware resources for each jail. Still not as dynamic, but will get the job done.
      - charcircuit 1y ago
        Sure, but this is not done automatically for the user.
        bee_rider 1y ago
        For the types of computers BSD is typically run on, just unplug the webcam.
    - wahern 1y ago
      FreeBSD literally has Capsicum: https://en.wikipedia.org/wiki/Capsicum_(Unix) https://en.wikipedia.org/wiki/Capsicum_(Unix) That might be the most pure capability system out of all of them, though it's not something that works without application modification (yet). Android and iOS applications can automatically work with the native capability framework because they rely on higher-level SDK APIs. But AFAIU those capability systems are very coarse-grained, in the sense that it's difficult leverage the capability system internally within a single application. And keeping lower-level APIs (e.g. for C and POSIX filesystem I/O) nominally working (if at all) requires some impure hacks. All of which makes them very similar to FreeBSD Jails or Linux containers in that respect. I wouldn't consider any of these systems "secure", though, as a practical matter. In terms of preventing a breakout, I'd trust an application on OpenBSD with strict pledge and unveil limits, or a Linux process in a classic seccomp sandbox (i.e. only read, write, and exit syscalls), more than any of those other systems. Maybe Capsicum, too, but I'm not familiar enough with the implementation to know how well it limits kernel code surface area. But any application that can poke at (directly or indirectly) complicated hardware, like the GPU, is highly problematic unless there are proofs of correctness for any series of inputs that can be sent by the process (which I don't think is the case).
    - resource_waste 1y ago
      iOS so so insecure that thousands of people have been hacked and at least 1 person was killed. The last place in security is iOS.
    - o11c 1y ago
      IMO, the real problem with trying to enforce capability-based systems on desktop/server environments is the correct API isn't implemented. `capabilities(7)` is only a tiny subset of `credentials(7)`, `PR_SET_NO_NEW_PRIVS` is an abomination, `SCM_RIGHTS` has warts, and `close_range` is fundamentally braindead. We need at least the following sets: effective, permitted, bounding (per escalation method?), and the ability to make a copy of all of the preceding to automatically apply to a child (or to ourselves if we request an atomic change). Linux's `inheritable` set is just confusing, and confusion means people will use it wrong. At least we aren't Windows.
  - 8fingerlouie 1y ago
    A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. Take filesystems, the official filesystems are UFS(1/2) and ZFS. They have GEOM as LVM and LUKS and more. That being said, the majority of money and development goes into Linux, which by itself may make it a better system (eventually). Edit: Of course UFS is not deprecated.
    - assimpleaspossi 1y ago
      UFS is not deprecated on FreeBSD.
      - hxorr 1y ago
        I believe it is the default on netBSD
    - graemep 1y ago
      > A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. The right comparison is not between a particular BSD and Linux, its between a particular BSD and a Linux distro.
      - jeltz 1y ago
        I feel the BSDs are much more different from each other than the average Linux distros are.
        graemep 1y ago
        Average/most popular distros, maybe. The full range of distros are very different from each other. Consider Void, Alpine, Gentoo, Chimera, NixOS..... Different C libraries, init systems, different default command line utilities....
  - NexRebular 1y ago
    > I'm pretty sure, that the BSD family is pretty mature and secure. Not to mention illumos-based systems too.
    - johannes1234321 1y ago
      I ran Open Solaris for a while on my Laptop and it's quite nice. However the lack of support by practically any software vendor made many things a pain. Since then even more stuff went to the Web, but I really I doubt Illumos got any extra traction.
      - NexRebular 1y ago
        Most of our server infrastructure runs on illumos at $work. SmartOS/Triton handles our "cloud" and OmniOS runs our storage. The linux monoculture problem luckily can still be handled with zones and bhyve, and I do trust illumos developers' competence to deliver good quality secure software a lot more than linux developers' as well. Now if FreeBSD (or indeed illumos) would get CUDA-support we could stop using linux for GPU nodes too.
        throw0101b 1y ago
        > Now if FreeBSD (or indeed illumos) would get CUDA-support we could stop using linux for GPU nodes too. Could you not run Linux CUDA binaries under FreeBSD's Linuxulator?
        NexRebular 1y ago
        It is possible, yes, but I would prefer to have full linux-free support for production use. There is on-going work for FreeBSD Cuda, though[0]. Just have to wait and see. [0] https://www.freebsd.org/status/report-2024-04-2024-06/#_partnerships_and_research https://www.freebsd.org/status/report-2024-04-2024-06/#_part...
  - bee_rider 1y ago
    BSD doesn’t count, everybody agrees it is the best OS they aren’t using.
pandemic_region 1y ago
> I have to say it remains an eternal experiment You just defined 'life' in general.
subscribed 1y ago
That's certainly an interesting standpoint. I use both privately and professionally and while I accept that security-wise (even with selinux) they feel lacking, feature-wise they far exceed Windows I use as my other is except in gaming experience. I wish I had something like GrapheneOS on desktops (yes I know about Qubes)
- throawayonthe 1y ago
  same! qubes is probably the actual solution for now, but i've seen some grapheneos people work on https://secureblue.dev/ https://secureblue.dev/ and that seems a lot more "normal"
  - udev4096 1y ago
    I have been meaning to try out secureblue and hopefully even run it on production VMs in proxmox. Is it stable yet?
- IlikeKitties 1y ago
  > I wish I had something like GrapheneOS on desktops (yes I know about Qubes) SecureBlue and Kicksecure are the closest equivalents.
  - mathverse 1y ago
    No the closest alternative is https://grsecurity.net/ https://grsecurity.net/
    - IlikeKitties 1y ago
      Factually wrong from that very site > grsecurity® is the only drop-in Linux kernel replacement offering high-performance, state-of-the-art exploit prevention against both known and unknown threats. While secureblue is a full desktop distro (not just a kernel) that integrates key grapheneos hardening tools like their hardened malloc and forks of their hardened chromium and works with flatpak as a base for hardened application deployment. grsecurity does literally none of that.
sneak 1y ago
Local root privilege escalation is mostly irrelevant these days. It’s only useful as part of an exploit chain, really. It’s not like shell servers are still around.
- magicalhippo 1y ago
  An exploit chain, like combining it with the PAM issue they mentioned in the very same article, affecting Fedora.
  - TheDong 1y ago
    The article was about two issues that combine to make a single local-privilege-escalation, so the PAM thing isn't a separate exploit chain, it's just part of getting local root in this vulnerability. What the parent poster meant is that you first need a way to run arbitrary code before local privilege escalation matters, so the exploit chain has to include _something_ that gets you local code execution. I tend to agree with the parent poster, for most modern single-user linux devices, local privilege escalation means almost nothing. Like, I'm the only user on my laptop. If you get arbitrary code execution as my user, you can log my keystrokes, steal my passwords and browser sessions, steal my bitcoin wallet, and persist reasonably well.... and once you've stolen my password via say keylogging me typing `sudo`, you now have root too. If you have a local privilege escalation too, you still get my passwords, bitcoin wallet, etc, and also uh... you can persist yourself better by injecting malware into sshd or something or modifying my package manager? idk, seems like it's about the same.
    - simoncion 1y ago
      > ...for most modern single-user linux devices, local privilege escalation means almost nothing. I haven't actually looked at the numbers, but I strongly suspect that it's true that the overwhelming majority of single-user Linux devices out there are Android devices. If that's true, then it's my understanding that Android does bother to fairly properly sandbox programs from each other... so an escalation to root would actually be a significant gain in access.
deleted 1y ago
[deleted]
devnullbrain 1y ago
>20 years ago So while Windows was letting everyone be root?
amelius 1y ago
What especially feels like an experiment is container technology.
- coderatlarge 1y ago
  how much harder is container escaping compared to vm escaping? i understand that containers are not truly meant to be security boundaries but they are often thought of and even used as such.
  - fc417fc802 1y ago
    > how much harder is container escaping compared to vm escaping? The answer heavily depends on your configuration. Unprivileged with a spartan syscall filter and a security profile is very different than privileged with the GPU bindmounted in (the latter amounts to a chroot and a separate user account).
    - tetha 1y ago
      Hence if I ever get money for an infrastructure pentest, I want to include a scenario that scares me a bit: The hijacked application server. The pentesters give me a container with whatever tooling they want and a reverse shell and that gets deployed in the dev-infrastructure, once privileged and once unprivileged, both with a few secrets an application server would have. I'd just reuse a deployment config from some job. And then have at it. And yes, this will most likely be a mess.
  - arbll 1y ago
    Situational but if you're in default configurations it's comparable. Both will need some form of unknown vuln. It boils down to wether you trust more the linux namespacing logic and container runtime glue or the hypervisor logic.
franga2000 1y ago
Re:"Eternal experiment"... have you seen Windows 11? Or even 10? The devs can't keep their hands off of the thing, changing, breaking and fixing every component every few months.
- Geezus_42 1y ago
  Adding ADs to every possible surface, finding new ways to obfuscate built-in spyware
  - layer8 1y ago
    Active Directories?
    - cjg 1y ago
      Adverts.
- bee_rider 1y ago
  I don’t think we need to “whatabout” Windows. I don’t think anyone would say they are trying too many experiments… actually, Windows feels like it was mostly made by overworked folks doing the bare minimum to not get fired. No time for experiments or caring.
- phendrenad2 1y ago
  This is the attitude that holds Linux back the most. Quick, what is the #1 priority of Linux? "Being better than Windows". Not being good, great, or even amazing? No, as long as it's 0.0001% better than Windows, it can be awful! And people will say "Yeah, but it is amazing". Then why do so many people feel the need to defend it in terms of _being better than Windows_? Clearly they prioritize the perception of being better than Windows over being actually good, because otherwise they would defend it by pointing out how good it is. Are they all just weirdos, or have they subconsciously picked up on the real but unwritten culture of Linux?
yusina 1y ago
Software is rarely "done", so is quite naturally always an evolving experiment of sorts.
jpnc 1y ago
That goes for all (active) software really. Otherwise people call it obsolete or abandoned.
0points 1y ago
We're talking about a local privilege escalation here. That assumes: 1) Attacker already have an account on the system 2) The app `udisks` is installed on the system. Everyone is fighting the same battle and it's a good thing. It is happening because the rest of the system is hard enough to attack these days. This is true for all major OS:es. Only fanboys bend reality to make this into a good-vs-bad argument.
resource_waste 1y ago
Let us not pretend other OS are flawless as well. Microsoft is constantly patching and Apple has been the source of so many hacks that thousands of VIPs were affected and a person was murdered.
- danparsonson 1y ago
  What a weird comment - if Apple software had less exploits then the murder would have been averted? And those 'VIPs', whoever they are - would it be less significant if there were normies? I sincerely hope none of my coding mistakes ever causes a VIP to be murdered.

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

stavros 1y ago

If you think Linux is an experiment, you should see the other OSes.

khurs 1y ago
Including Openbsd?
ahofmann 1y ago
I'm pretty sure, that the BSD family is pretty mature and secure. Linux is just good enough for most people.
- deleted 1y ago
  [deleted]
- charcircuit 1y ago
  >is pretty mature and secure They are still missing something like capability based security like iOS and Android have where apps have to be granted access to use things like files or the camera. It may have been considered secure a couple decades ago, but they have fallen behind the competiton.
  - NexRebular 1y ago
    > They are still missing something like capability based security ...like Capsicum? https://wiki.freebsd.org/Capsicum https://wiki.freebsd.org/Capsicum
    - charcircuit 1y ago
      No, that requires explicit changes by programs to use meaning that malware can ignore it and steal your browser's cookies and take secret photos with your webcam.
      - NexRebular 1y ago
        So the capability-based security framework is not missing unlike your original statement?
        charcircuit 1y ago
        My original statement is about how users have to explicitly give programs access to the files and the webcam before they can use them. This is missing.
  - 8fingerlouie 1y ago
    You can use Jails and limit access to hardware resources for each jail. Still not as dynamic, but will get the job done.
    - charcircuit 1y ago
      Sure, but this is not done automatically for the user.
      - bee_rider 1y ago
        For the types of computers BSD is typically run on, just unplug the webcam.
  - wahern 1y ago
    FreeBSD literally has Capsicum: https://en.wikipedia.org/wiki/Capsicum_(Unix) https://en.wikipedia.org/wiki/Capsicum_(Unix) That might be the most pure capability system out of all of them, though it's not something that works without application modification (yet). Android and iOS applications can automatically work with the native capability framework because they rely on higher-level SDK APIs. But AFAIU those capability systems are very coarse-grained, in the sense that it's difficult leverage the capability system internally within a single application. And keeping lower-level APIs (e.g. for C and POSIX filesystem I/O) nominally working (if at all) requires some impure hacks. All of which makes them very similar to FreeBSD Jails or Linux containers in that respect. I wouldn't consider any of these systems "secure", though, as a practical matter. In terms of preventing a breakout, I'd trust an application on OpenBSD with strict pledge and unveil limits, or a Linux process in a classic seccomp sandbox (i.e. only read, write, and exit syscalls), more than any of those other systems. Maybe Capsicum, too, but I'm not familiar enough with the implementation to know how well it limits kernel code surface area. But any application that can poke at (directly or indirectly) complicated hardware, like the GPU, is highly problematic unless there are proofs of correctness for any series of inputs that can be sent by the process (which I don't think is the case).
  - resource_waste 1y ago
    iOS so so insecure that thousands of people have been hacked and at least 1 person was killed. The last place in security is iOS.
  - o11c 1y ago
    IMO, the real problem with trying to enforce capability-based systems on desktop/server environments is the correct API isn't implemented. `capabilities(7)` is only a tiny subset of `credentials(7)`, `PR_SET_NO_NEW_PRIVS` is an abomination, `SCM_RIGHTS` has warts, and `close_range` is fundamentally braindead. We need at least the following sets: effective, permitted, bounding (per escalation method?), and the ability to make a copy of all of the preceding to automatically apply to a child (or to ourselves if we request an atomic change). Linux's `inheritable` set is just confusing, and confusion means people will use it wrong. At least we aren't Windows.
- 8fingerlouie 1y ago
  A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. Take filesystems, the official filesystems are UFS(1/2) and ZFS. They have GEOM as LVM and LUKS and more. That being said, the majority of money and development goes into Linux, which by itself may make it a better system (eventually). Edit: Of course UFS is not deprecated.
  - assimpleaspossi 1y ago
    UFS is not deprecated on FreeBSD.
    - hxorr 1y ago
      I believe it is the default on netBSD
  - graemep 1y ago
    > A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. The right comparison is not between a particular BSD and Linux, its between a particular BSD and a Linux distro.
    - jeltz 1y ago
      I feel the BSDs are much more different from each other than the average Linux distros are.
      - graemep 1y ago
        Average/most popular distros, maybe. The full range of distros are very different from each other. Consider Void, Alpine, Gentoo, Chimera, NixOS..... Different C libraries, init systems, different default command line utilities....
- NexRebular 1y ago
  > I'm pretty sure, that the BSD family is pretty mature and secure. Not to mention illumos-based systems too.
  - johannes1234321 1y ago
    I ran Open Solaris for a while on my Laptop and it's quite nice. However the lack of support by practically any software vendor made many things a pain. Since then even more stuff went to the Web, but I really I doubt Illumos got any extra traction.
    - NexRebular 1y ago
      Most of our server infrastructure runs on illumos at $work. SmartOS/Triton handles our "cloud" and OmniOS runs our storage. The linux monoculture problem luckily can still be handled with zones and bhyve, and I do trust illumos developers' competence to deliver good quality secure software a lot more than linux developers' as well. Now if FreeBSD (or indeed illumos) would get CUDA-support we could stop using linux for GPU nodes too.
      - throw0101b 1y ago
        > Now if FreeBSD (or indeed illumos) would get CUDA-support we could stop using linux for GPU nodes too. Could you not run Linux CUDA binaries under FreeBSD's Linuxulator?
        NexRebular 1y ago
        It is possible, yes, but I would prefer to have full linux-free support for production use. There is on-going work for FreeBSD Cuda, though[0]. Just have to wait and see. [0] https://www.freebsd.org/status/report-2024-04-2024-06/#_partnerships_and_research https://www.freebsd.org/status/report-2024-04-2024-06/#_part...
- bee_rider 1y ago
  BSD doesn’t count, everybody agrees it is the best OS they aren’t using.

pandemic_region 1y ago

> I have to say it remains an eternal experiment You just defined 'life' in general.

subscribed 1y ago

That's certainly an interesting standpoint. I use both privately and professionally and while I accept that security-wise (even with selinux) they feel lacking, feature-wise they far exceed Windows I use as my other is except in gaming experience. I wish I had something like GrapheneOS on desktops (yes I know about Qubes)

throawayonthe 1y ago
same! qubes is probably the actual solution for now, but i've seen some grapheneos people work on https://secureblue.dev/ https://secureblue.dev/ and that seems a lot more "normal"
- udev4096 1y ago
  I have been meaning to try out secureblue and hopefully even run it on production VMs in proxmox. Is it stable yet?
IlikeKitties 1y ago
> I wish I had something like GrapheneOS on desktops (yes I know about Qubes) SecureBlue and Kicksecure are the closest equivalents.
- mathverse 1y ago
  No the closest alternative is https://grsecurity.net/ https://grsecurity.net/
  - IlikeKitties 1y ago
    Factually wrong from that very site > grsecurity® is the only drop-in Linux kernel replacement offering high-performance, state-of-the-art exploit prevention against both known and unknown threats. While secureblue is a full desktop distro (not just a kernel) that integrates key grapheneos hardening tools like their hardened malloc and forks of their hardened chromium and works with flatpak as a base for hardened application deployment. grsecurity does literally none of that.

sneak 1y ago

Local root privilege escalation is mostly irrelevant these days. It’s only useful as part of an exploit chain, really. It’s not like shell servers are still around.

magicalhippo 1y ago
An exploit chain, like combining it with the PAM issue they mentioned in the very same article, affecting Fedora.
- TheDong 1y ago
  The article was about two issues that combine to make a single local-privilege-escalation, so the PAM thing isn't a separate exploit chain, it's just part of getting local root in this vulnerability. What the parent poster meant is that you first need a way to run arbitrary code before local privilege escalation matters, so the exploit chain has to include _something_ that gets you local code execution. I tend to agree with the parent poster, for most modern single-user linux devices, local privilege escalation means almost nothing. Like, I'm the only user on my laptop. If you get arbitrary code execution as my user, you can log my keystrokes, steal my passwords and browser sessions, steal my bitcoin wallet, and persist reasonably well.... and once you've stolen my password via say keylogging me typing `sudo`, you now have root too. If you have a local privilege escalation too, you still get my passwords, bitcoin wallet, etc, and also uh... you can persist yourself better by injecting malware into sshd or something or modifying my package manager? idk, seems like it's about the same.
  - simoncion 1y ago
    > ...for most modern single-user linux devices, local privilege escalation means almost nothing. I haven't actually looked at the numbers, but I strongly suspect that it's true that the overwhelming majority of single-user Linux devices out there are Android devices. If that's true, then it's my understanding that Android does bother to fairly properly sandbox programs from each other... so an escalation to root would actually be a significant gain in access.

deleted 1y ago

[deleted]

devnullbrain 1y ago

>20 years ago So while Windows was letting everyone be root?

amelius 1y ago

What especially feels like an experiment is container technology.

coderatlarge 1y ago
how much harder is container escaping compared to vm escaping? i understand that containers are not truly meant to be security boundaries but they are often thought of and even used as such.
- fc417fc802 1y ago
  > how much harder is container escaping compared to vm escaping? The answer heavily depends on your configuration. Unprivileged with a spartan syscall filter and a security profile is very different than privileged with the GPU bindmounted in (the latter amounts to a chroot and a separate user account).
  - tetha 1y ago
    Hence if I ever get money for an infrastructure pentest, I want to include a scenario that scares me a bit: The hijacked application server. The pentesters give me a container with whatever tooling they want and a reverse shell and that gets deployed in the dev-infrastructure, once privileged and once unprivileged, both with a few secrets an application server would have. I'd just reuse a deployment config from some job. And then have at it. And yes, this will most likely be a mess.
- arbll 1y ago
  Situational but if you're in default configurations it's comparable. Both will need some form of unknown vuln. It boils down to wether you trust more the linux namespacing logic and container runtime glue or the hypervisor logic.

franga2000 1y ago

Re:"Eternal experiment"... have you seen Windows 11? Or even 10? The devs can't keep their hands off of the thing, changing, breaking and fixing every component every few months.

Geezus_42 1y ago
Adding ADs to every possible surface, finding new ways to obfuscate built-in spyware
- layer8 1y ago
  Active Directories?
  - cjg 1y ago
    Adverts.
bee_rider 1y ago
I don’t think we need to “whatabout” Windows. I don’t think anyone would say they are trying too many experiments… actually, Windows feels like it was mostly made by overworked folks doing the bare minimum to not get fired. No time for experiments or caring.
phendrenad2 1y ago
This is the attitude that holds Linux back the most. Quick, what is the #1 priority of Linux? "Being better than Windows". Not being good, great, or even amazing? No, as long as it's 0.0001% better than Windows, it can be awful! And people will say "Yeah, but it is amazing". Then why do so many people feel the need to defend it in terms of _being better than Windows_? Clearly they prioritize the perception of being better than Windows over being actually good, because otherwise they would defend it by pointing out how good it is. Are they all just weirdos, or have they subconsciously picked up on the real but unwritten culture of Linux?

yusina 1y ago

Software is rarely "done", so is quite naturally always an evolving experiment of sorts.

jpnc 1y ago

That goes for all (active) software really. Otherwise people call it obsolete or abandoned.

0points 1y ago

We're talking about a local privilege escalation here. That assumes: 1) Attacker already have an account on the system 2) The app `udisks` is installed on the system. Everyone is fighting the same battle and it's a good thing. It is happening because the rest of the system is hard enough to attack these days. This is true for all major OS:es. Only fanboys bend reality to make this into a good-vs-bad argument.

resource_waste 1y ago

Let us not pretend other OS are flawless as well. Microsoft is constantly patching and Apple has been the source of so many hacks that thousands of VIPs were affected and a person was murdered.

danparsonson 1y ago
What a weird comment - if Apple software had less exploits then the murder would have been averted? And those 'VIPs', whoever they are - would it be less significant if there were normies? I sincerely hope none of my coding mistakes ever causes a VIP to be murdered.