4 ms·

> users of an OS with a built-in file permissions system Lot of good that will do you when Linux users will curl | bash most any garbage. The Windows NT file

> users of an OS with a built-in file permissions system Lot of good that will do you when Linux users will curl | bash most any garbage. The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). > thinking about whom to trust and primarily sourcing their software from the distro package manager So "app store" is the wave of the future? The days of Linux users using magic healing crystals to protect themselves from malware are long over. Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you.

bayindirh 1y ago
> Lot of good that will do you when Linux users will curl | bash most any garbage. Same for Windows users who zoom through UAC prompts without reading. > The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). ...and much more convoluted and easy to break while most systems allow unfettered access to everywhere. On the other hand SELinux and AppArmor already provide transparent system isolation for decades now, and they are completely invisible. If you want even more security, you can install an immutable distro. > So "app store" is the wave of the future? App stores are capitalist versions of software repositories which are present for more than 20 years now? Plus, these repositories are generally well-vetted and observed by their maintainers. > Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you. No, instead many sysadmins who know what they're doing are depending on a layered security system, provided by Linux kernel and its peripheries. Containers, CGroups, namespaces, SELinux/AppArmor, package integrity checks, multiple limited users (with reduced capabilities as well), UNIX file permissions, and many more. If you think Linux only has file permissions for system security, I have news for you.
- charcircuit 1y ago
  >zoom through UAC prompts without reading. UAC is not a security boundary, so it is not relevant when talking about security. >SELinux and AppArmor already provide transparent system isolation for decades If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. >you can install an immutable distro. Even immutable distros let people download new software off the internet and run it. >Plus, these repositories are generally well-vetted and observed by their maintainers. This has been shown to be false in practice due to the xz backdoor. Maintainers do not actually vet anything other than that the code is coming from the developer. Which is also what app stores do.
  - akimbostrawman 1y ago
    >UAC is not a security boundary, so it is not relevant when talking about security. That is there excuses but you don't seem to realize that this makes it only worse because that means there is no boundary at all. >If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. new apps will be either installed from a trusted repository (often with a MAC profile) or sandboxed by default from flatpak/snap store. You don't seem to understand that the entire install process is different. You don't get your software from random sites found on Google between malware ads on Linux. >This has been shown to be false in practice due to the xz backdoor XZ has nothing to to with a lack of vetting and even if it was it would be an argument for it because it got caught in testing.
    - sugarpimpdorsey 1y ago
      > XZ has nothing to to with a lack of vetting and even if it was it would be an argument for it because it got caught in testing. This is absolutely false, it was not caught in any sort of regular testing whatsoever. It was caught by - of all people - a Microsoft employee who noticed SSH logins were taking a split second too long. Not distro packagers. The packages were already staged in the testing branches of the distros they were targeting and could have easily made it into the LTS versions had this one curious MS guy not noticed.
      - akimbostrawman 1y ago
        >This is absolutely false, it was not caught in any sort of regular testing whatsoever >The packages were already staged in the testing branches Thanks for making my argument for me. It was also literally caught in (Debian) TESTING. It does not matter for who he works unless you believe a cooperation owns there employees time and achievements 24/7. He notices something off, tested it, looked at the source code (impossible on windows ;) and reported the issue he found which got quickly and transparently (also impossible on windows) fixed. Again that is how FOSS should work and why it's superior to proprietary software.
      - bayindirh 1y ago

bayindirh 1y ago

> Lot of good that will do you when Linux users will curl | bash most any garbage. Same for Windows users who zoom through UAC prompts without reading. > The Windows NT file permission system is far more advanced (and I'm not even including AppLocker or software whitelisting). ...and much more convoluted and easy to break while most systems allow unfettered access to everywhere. On the other hand SELinux and AppArmor already provide transparent system isolation for decades now, and they are completely invisible. If you want even more security, you can install an immutable distro. > So "app store" is the wave of the future? App stores are capitalist versions of software repositories which are present for more than 20 years now? Plus, these repositories are generally well-vetted and observed by their maintainers. > Most malware these days targets Linux servers. If you think chmod u+x is what is preventing your computer from catching digital AIDS I have news for you. No, instead many sysadmins who know what they're doing are depending on a layered security system, provided by Linux kernel and its peripheries. Containers, CGroups, namespaces, SELinux/AppArmor, package integrity checks, multiple limited users (with reduced capabilities as well), UNIX file permissions, and many more. If you think Linux only has file permissions for system security, I have news for you.

charcircuit 1y ago
>zoom through UAC prompts without reading. UAC is not a security boundary, so it is not relevant when talking about security. >SELinux and AppArmor already provide transparent system isolation for decades If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. >you can install an immutable distro. Even immutable distros let people download new software off the internet and run it. >Plus, these repositories are generally well-vetted and observed by their maintainers. This has been shown to be false in practice due to the xz backdoor. Maintainers do not actually vet anything other than that the code is coming from the developer. Which is also what app stores do.
- akimbostrawman 1y ago
  >UAC is not a security boundary, so it is not relevant when talking about security. That is there excuses but you don't seem to realize that this makes it only worse because that means there is no boundary at all. >If they are setup and most Linux distros only limit individual apps. So a brand new app can still run wild. new apps will be either installed from a trusted repository (often with a MAC profile) or sandboxed by default from flatpak/snap store. You don't seem to understand that the entire install process is different. You don't get your software from random sites found on Google between malware ads on Linux. >This has been shown to be false in practice due to the xz backdoor XZ has nothing to to with a lack of vetting and even if it was it would be an argument for it because it got caught in testing.
  - sugarpimpdorsey 1y ago
    > XZ has nothing to to with a lack of vetting and even if it was it would be an argument for it because it got caught in testing. This is absolutely false, it was not caught in any sort of regular testing whatsoever. It was caught by - of all people - a Microsoft employee who noticed SSH logins were taking a split second too long. Not distro packagers. The packages were already staged in the testing branches of the distros they were targeting and could have easily made it into the LTS versions had this one curious MS guy not noticed.
    - akimbostrawman 1y ago
      >This is absolutely false, it was not caught in any sort of regular testing whatsoever >The packages were already staged in the testing branches Thanks for making my argument for me. It was also literally caught in (Debian) TESTING. It does not matter for who he works unless you believe a cooperation owns there employees time and achievements 24/7. He notices something off, tested it, looked at the source code (impossible on windows ;) and reported the issue he found which got quickly and transparently (also impossible on windows) fixed. Again that is how FOSS should work and why it's superior to proprietary software.
    - bayindirh 1y ago