4 ms·

Linux distributions have been shipping with secure boot support since 2012, so if that was the goal it had already failed over a decade ago.

by mjg59 1y ago

zahlman 1y ago
The Linux Mint support forums keep telling people to try turning it off to fix problems, but I installed Mint just fine with it enabled on my 8 (at the time) year old hardware, before I'd even heard that there was such a thing. Anyway, it's good to hear that I probably don't have anything to worry about.
- charcircuit 1y ago
  Unfortunately, hearing this is not surprising since desktop Linux users tolerate having poor security and rely on never ever running malware to keep themselves safe over having the operating system itself protect against malware.
  - zahlman 1y ago
    > Unfortunately, hearing this is not surprising since [users of an OS with a built-in file permissions system] tolerate having poor security and rely on [thinking about whom to trust and primarily sourcing their software from the distro package manager] to keep themselves safe over having the operating system itself [apply heuristics to try to decide whether things the user downloaded from random web sites are malware, while completely failing to provide transparency on whether double-clicking something will supply it as data to an existing program or treat it as itself a program]. I'm not understanding how it's the desktop Linux users who have to deal with poor security.
    - sugarpimpdorsey 1y ago
      > users of an OS with a built-in file permissions system Lot of good that will do you when Linux users will curl | bash most any garbage. The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). > thinking about whom to trust and primarily sourcing their software from the distro package manager So "app store" is the wave of the future? The days of Linux users using magic healing crystals to protect themselves from malware are long over. Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you.
      - bayindirh 1y ago
        > Lot of good that will do you when Linux users will curl | bash most any garbage. Same for Windows users who zoom through UAC prompts without reading. > The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). ...and much more convoluted and easy to break while most systems allow unfettered access to everywhere. On the other hand SELinux and AppArmor already provide transparent system isolation for decades now, and they are completely invisible. If you want even more security, you can install an immutable distro. > So "app store" is the wave of the future? App stores are capitalist versions of software repositories which are present for more than 20 years now? Plus, these repositories are generally well-vetted and observed by their maintainers. > Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you. No, instead many sysadmins who know what they're doing are depending on a layered security system, provided by Linux kernel and its peripheries. Containers, CGroups, namespaces, SELinux/AppArmor, package integrity checks, multiple limited users (with reduced capabilities as well), UNIX file permissions, and many more. If you think Linux only has file permissions for system security, I have news for you.
        charcircuit 1y ago
        >zoom through UAC prompts without reading. UAC is not a security boundary, so it is not relevant when talking about security. >SELinux and AppArmor already provide transparent system isolation for decades If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. >you can install an immutable distro. Even immutable distros let people download new software off the internet and run it. >Plus, these repositories are generally well-vetted and observed by their maintainers. This has been shown to be false in practice due to the xz backdoor. Maintainers do not actually vet anything other than that the code is coming from the developer. Which is also what app stores do.
        akimbostrawman 1y ago
        >UAC is not a security boundary, so it is not relevant when talking about security. That is there excuses but you don't seem to realize that this makes it only worse because that means there is no boundary at all. >If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. new apps will be either installed from a trusted repository (often with a MAC profile) or sandboxed by default from flatpak/snap store. You don't seem to understand that the entire install process is different. You don't get your software from random sites found on Google between malware ads on Linux. >This has been shown to be false in practice due to the xz backdoor XZ has nothing to to with a lack of vetting and even if it was it would be an argument for it because it got caught in testing.
    - charcircuit 1y ago
      >I'm not understanding how it's the desktop Linux users who have to deal with poor security. On Linux Mint if you run a program without granting any extra permissions it can: Record your mic, record your camera, record your screen, steal your browser history/ cookies/passwords, alias sudo or show a fake update dialog to collect the user's password to elevate to root, see if you copied a crypto address and replace it with a similar looking one owned by the attacker, encrypt all of your files, send any sensitive pictures or documents to the attacker, etc. The existence of a 50 year old concept of file permission is not good enough to combat the modern security problems users can encounter.
    - literalAardvark 1y ago
      Because you're starting from a poor understanding of the security process in general. File permissions are the least of your worries.
  - AAAAaccountAAAA 1y ago
    The desktop security model is pretty much the same across the vendors. Somehow, Microsoft seems to get a free pass on this.
  - akimbostrawman 1y ago
    Of course unlike windows billion dollar heightened security of getting flooded with UAC and MOTW pops up everybody is conditioned to click yes as fast as possible caused by the proven "download random executables from the first site you see on google and hope it's not malwaretising" method.

Linux distributions have been shipping with secure boot support since 2012, so if that was the goal it had already failed over a decade ago.

by mjg59 1y ago

Linux distributions have been shipping with secure boot support since 2012, so if that was the goal it had already failed over a decade ago.

zahlman 1y ago

The Linux Mint support forums keep telling people to try turning it off to fix problems, but I installed Mint just fine with it enabled on my 8 (at the time) year old hardware, before I'd even heard that there was such a thing. Anyway, it's good to hear that I probably don't have anything to worry about.

charcircuit 1y ago
Unfortunately, hearing this is not surprising since desktop Linux users tolerate having poor security and rely on never ever running malware to keep themselves safe over having the operating system itself protect against malware.
- zahlman 1y ago
  > Unfortunately, hearing this is not surprising since [users of an OS with a built-in file permissions system] tolerate having poor security and rely on [thinking about whom to trust and primarily sourcing their software from the distro package manager] to keep themselves safe over having the operating system itself [apply heuristics to try to decide whether things the user downloaded from random web sites are malware, while completely failing to provide transparency on whether double-clicking something will supply it as data to an existing program or treat it as itself a program]. I'm not understanding how it's the desktop Linux users who have to deal with poor security.
  - sugarpimpdorsey 1y ago
    > users of an OS with a built-in file permissions system Lot of good that will do you when Linux users will curl | bash most any garbage. The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). > thinking about whom to trust and primarily sourcing their software from the distro package manager So "app store" is the wave of the future? The days of Linux users using magic healing crystals to protect themselves from malware are long over. Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you.
    - bayindirh 1y ago
      > Lot of good that will do you when Linux users will curl | bash most any garbage. Same for Windows users who zoom through UAC prompts without reading. > The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). ...and much more convoluted and easy to break while most systems allow unfettered access to everywhere. On the other hand SELinux and AppArmor already provide transparent system isolation for decades now, and they are completely invisible. If you want even more security, you can install an immutable distro. > So "app store" is the wave of the future? App stores are capitalist versions of software repositories which are present for more than 20 years now? Plus, these repositories are generally well-vetted and observed by their maintainers. > Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you. No, instead many sysadmins who know what they're doing are depending on a layered security system, provided by Linux kernel and its peripheries. Containers, CGroups, namespaces, SELinux/AppArmor, package integrity checks, multiple limited users (with reduced capabilities as well), UNIX file permissions, and many more. If you think Linux only has file permissions for system security, I have news for you.
      - charcircuit 1y ago
        >zoom through UAC prompts without reading. UAC is not a security boundary, so it is not relevant when talking about security. >SELinux and AppArmor already provide transparent system isolation for decades If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. >you can install an immutable distro. Even immutable distros let people download new software off the internet and run it. >Plus, these repositories are generally well-vetted and observed by their maintainers. This has been shown to be false in practice due to the xz backdoor. Maintainers do not actually vet anything other than that the code is coming from the developer. Which is also what app stores do.
        akimbostrawman 1y ago
        >UAC is not a security boundary, so it is not relevant when talking about security. That is there excuses but you don't seem to realize that this makes it only worse because that means there is no boundary at all. >If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. new apps will be either installed from a trusted repository (often with a MAC profile) or sandboxed by default from flatpak/snap store. You don't seem to understand that the entire install process is different. You don't get your software from random sites found on Google between malware ads on Linux. >This has been shown to be false in practice due to the xz backdoor XZ has nothing to to with a lack of vetting and even if it was it would be an argument for it because it got caught in testing.
  - charcircuit 1y ago
    >I'm not understanding how it's the desktop Linux users who have to deal with poor security. On Linux Mint if you run a program without granting any extra permissions it can: Record your mic, record your camera, record your screen, steal your browser history/ cookies/passwords, alias sudo or show a fake update dialog to collect the user's password to elevate to root, see if you copied a crypto address and replace it with a similar looking one owned by the attacker, encrypt all of your files, send any sensitive pictures or documents to the attacker, etc. The existence of a 50 year old concept of file permission is not good enough to combat the modern security problems users can encounter.
  - literalAardvark 1y ago
    Because you're starting from a poor understanding of the security process in general. File permissions are the least of your worries.
- AAAAaccountAAAA 1y ago
  The desktop security model is pretty much the same across the vendors. Somehow, Microsoft seems to get a free pass on this.
- akimbostrawman 1y ago
  Of course unlike windows billion dollar heightened security of getting flooded with UAC and MOTW pops up everybody is conditioned to click yes as fast as possible caused by the proven "download random executables from the first site you see on google and hope it's not malwaretising" method.