3 ms·

Macs come with an Apple provided antivirus built in, it's called XProtect. Apple also has enforced a similar policy to what Google is doing, but much stricter,

Macs come with an Apple provided antivirus built in, it's called XProtect. Apple also has enforced a similar policy to what Google is doing, but much stricter, and has done for ~13 years or so (devs must be identified, the OS rejects unsigned code in all territories by default, Apple pre-approves all binaries even outside the app store). Linux distros have policies far more extreme than anything Google, Apple or Microsoft have ever done. They explicitly don't support installing any software not provided by their "app stores". Getting into those requires giving up your source code to them, and they reserve the right to modify it as they see fit without informing anyone, reject it for any reason or no reason at all (including reasons like "we don't have time"), and they tie getting new releases of your app to the user upgrading to new releases of the OS. If you do try and install stuff from outside of your distribution, not only are there security warnings to click through but an expected outcome is that the OS breaks and the vendor washes their hands of you. Despite those policies, or perhaps because of them, botnets of Linux servers are common. Of all consumer-facing platforms only Windows and Android allow installation of unsigned third party code out of the box via some obvious graphical path. And on Windows that right is somewhat theoretical. You can do it but the built in browser will try very hard to stop you, and the OS itself will happily break unsigned code by blocking file open syscalls heuristically. So in practice most apps don't go the unsigned route. On Android OTOH, unsigned (non ID verified) code is sandboxed and works just like regular apps after installation, the OS won't heuristically interfere with the app.

BLKNSLVR 1y ago
That's an interesting take on Linux. I see it as a lot closer to what Windows programs were like back in the day, where you can install whatever you want. Linux distributions each have their built in package managers, but there's no 'policy', as I understand it, that prevents installation of, literally, whatever you want. It's generally more difficult than just downloading and double clicking on the installer / exe, but just follow the instructions and it's done. And, yes, also there are weird version and dependency issues that crop up more than would be ideal, but that's not the topic.
- mike_hearn 1y ago
  There's no such policy on any OS except iOS I believe. You can override the security mechanisms on every other OS. The question is only how hard is it? On Linux, worst case, it can easily require compiling the program from source. If Apple or Microsoft imposed a policy that said you can install whatever you want but only by compiling from source, people would lose their minds! And, note, back when I was a Linux user, distro vendors and evangelists justified that situation by security. They said we don't want people distributing software outside of our repositories because that's how Windows users get viruses, so we deliberately won't make it any easier. So the Linux community doesn't get to cry freedom and decentralization now, IMHO. The time to do that was 25 years ago when Debian was being praised for having big repositories. Some of us actually did point out how centralized and authoritarian that approach was, I even built a system for distributing apps in binary form to all distros (with hacks and shims for binary compatibility), and that projects attracted some volunteers, but we got pilloried for not "getting" UNIX. One Debian developer even called us monkeys. The users got tired of this and bypassed them with Docker, a much more decentralized system in which anyone can publish images without binary compatibility problems, and using them isn't tied to your OS version or OS vendor policies. But Docker is also centralized around Docker Hub, and Docker Inc do ban images and developers when malware is found: https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/ https://jfrog.com/blog/attacks-on-docker-with-millions-of-ma... Not so different to what the app stores do. It's fair to say that the only OS vendors who have ever taken decentralized and free app distribution seriously are Apple, MS and Google. The open source world went all-in on the centralized store model from the start and never looked back.
  - detaro 1y ago
    External, non-distro-maintained package repositories have been common for ages. I was still in elementary school, so my memory is a bit fuzzy, but I'm fairly sure downloading and installing individual packages was something I did too in the 90s. And fundamentally, any system that is open enough that "you can compile whatever you want on the device" is an option can also have binaries distributed. Sure, the Linux ecosystem has not prioritized binary compatibility as much, so doing so has been harder, people culturally expected "use existing libraries" more than "just bundle everything", but as you note that attitude has shifted too and it always was possible, and nothing seriously suggested preventing it.
AnthonyMouse 1y ago
> They explicitly don't support installing any software not provided by their "app stores". Most Linux distributions don't prevent you from installing third party software at all. You download something, you set the execute bit, it runs. Users are wary of doing that with software from untrusted sources because, obviously, you're then placing your trust in whoever provided the software instead of the distribution's packaging team. But the OS won't stop you if that's what you want to do, and sometimes you do trust the source of the software. > Despite those policies, or perhaps because of them, botnets of Linux servers are common. Botnets of Linux servers are common because some people operate them without security installing updates (common with WordPress), and then attackers exploit known vulnerabilities in the unpatched software. But "locked" phone platforms regularly discontinue security updates for devices that are still in widespread use. Locking the device doesn't solve that problem at all, and in fact makes it worse because then if the OEM doesn't patch it nobody else can do it either.
- mike_hearn 1y ago
  You're conflating "allow" and "support". The OS doesn't stop you installing third party software - signed or not - on macOS, Windows or Android, so "allow" is nothing interesting. That also won't be changing with Android, given that you can buy a phone with an unlockable bootloader and reflash to some other spin of Android that implements whatever security policies you want. You can put these devices into a mode that allows anything. The question is whether that's something the vendors make easy, if they support it in the sense that you can do it and they will still deal with you if there's a problem. That's what support means. It's not a synonym for technically possible. Windows, macOS and Android don't consider installing third party software to put the system in an unsupported state. Linux vendors do.
  - swiftcoder 1y ago
    This has not been true on macOS in some time - you have to go to considerable lengths to install unsigned software at this point. I recently upgraded macOS, and it took me a couple of reboots and scarily-worded system configuration changes to re-enable (signed) kernel extensions…
cherryteastain 1y ago
> They explicitly don't support installing any software not provided by their "app stores". Nonsense. You can and run install whatever you want. Tons of closed source commercial software available for Linux like Matlab come as a .tar file which you extract and run.
- mattdm 1y ago
  In Fedora, we don't "support" third-party packages or installation of software because we can't do much about it if something is wrong. You should go to the provider of the software for help. But we certainly support your _ability_ to install and run whatever you want. It's your computer, and it's your OS.
  - mike_hearn 1y ago
    Regardless of the party line, in practice there's no big distinction between not caring if it works or not and not allowing it. The difference only matters for highly technical people with lots of time on their hands. For everyone else, if it's not a paved road it's not a road they can travel on at all, and so in practice Linux historically did not "support" third party software in any meaningful way. And although I was making that argument to Fedora decades ago, it's only recently that this point has been accepted with official support by Red Hat for stuff like Flatpak. Of course other distros developed their own thing as always so it's still not really ideal. But at least the principle was now accepted that third party apps should have a properly supported way to thrive. Far too late, but it's done.
guimplen 1y ago
This is so blatantly wrong. On macs it became a little bit hrder very recently (you need to tick a checkmark in the system setting to allow untrusted program running) otherwise you just need to run the program once via right-click. On most user-friendly linux distros you can just run installer of any program.
- swiftcoder 1y ago
  It’s a lot harder than that now in macOS - now you have to individually approve each new unsigned binary through the system preferences security panel.
Der_Einzige 1y ago
How can you be so aggressively wrong about so many things in a single post? It’s impressive. The stuff about Linux not letting you install stuff flies far in the face of like everyone’s knowledge of Linux. Your description of how Linux installation works is pure fantasy.
- mike_hearn 1y ago
  I didn't say it didn't "let" you. I said it's not supported, as in, the Linux vendors don't consider that to be a feature of the OS that you should actually use. I've been a Linux user for 25 years. You can reconfigure the OS to use additional repositories. It may or may not work, and only if there is a repository specific to both your distro and its version. But it's not a good idea. In particular, OS upgrades are very likely to break. Being able to upgrade itself is a basic requirement of any modern OS. If your Linux distro corrupts itself on upgrade or fails to do so and you file a bug report you'll be told to remove any third party software because that's not supported. This would be like if your Mac started crashing on boot because you downloaded a word processor from a website, and then Apple say "sorry, we only support apps coming from the app store". They don't do that, but Red Hat or Canonical will.
engeljohnb 1y ago
> They explicitly don't support installing any software not provided by their "app stores". Getting into those requires giving up your source code to them, and they reserve the right to modify it as they see fit without informing anyone I've used Ubuntu, Debian, Manjaro, Mint, and Fedora, and none of them are like this. Which distro do you use that doesn't let you install any software you want?

BLKNSLVR 1y ago

That's an interesting take on Linux. I see it as a lot closer to what Windows programs were like back in the day, where you can install whatever you want. Linux distributions each have their built in package managers, but there's no 'policy', as I understand it, that prevents installation of, literally, whatever you want. It's generally more difficult than just downloading and double clicking on the installer / exe, but just follow the instructions and it's done. And, yes, also there are weird version and dependency issues that crop up more than would be ideal, but that's not the topic.

mike_hearn 1y ago
There's no such policy on any OS except iOS I believe. You can override the security mechanisms on every other OS. The question is only how hard is it? On Linux, worst case, it can easily require compiling the program from source. If Apple or Microsoft imposed a policy that said you can install whatever you want but only by compiling from source, people would lose their minds! And, note, back when I was a Linux user, distro vendors and evangelists justified that situation by security. They said we don't want people distributing software outside of our repositories because that's how Windows users get viruses, so we deliberately won't make it any easier. So the Linux community doesn't get to cry freedom and decentralization now, IMHO. The time to do that was 25 years ago when Debian was being praised for having big repositories. Some of us actually did point out how centralized and authoritarian that approach was, I even built a system for distributing apps in binary form to all distros (with hacks and shims for binary compatibility), and that projects attracted some volunteers, but we got pilloried for not "getting" UNIX. One Debian developer even called us monkeys. The users got tired of this and bypassed them with Docker, a much more decentralized system in which anyone can publish images without binary compatibility problems, and using them isn't tied to your OS version or OS vendor policies. But Docker is also centralized around Docker Hub, and Docker Inc do ban images and developers when malware is found: https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/ https://jfrog.com/blog/attacks-on-docker-with-millions-of-ma... Not so different to what the app stores do. It's fair to say that the only OS vendors who have ever taken decentralized and free app distribution seriously are Apple, MS and Google. The open source world went all-in on the centralized store model from the start and never looked back.
- detaro 1y ago
  External, non-distro-maintained package repositories have been common for ages. I was still in elementary school, so my memory is a bit fuzzy, but I'm fairly sure downloading and installing individual packages was something I did too in the 90s. And fundamentally, any system that is open enough that "you can compile whatever you want on the device" is an option can also have binaries distributed. Sure, the Linux ecosystem has not prioritized binary compatibility as much, so doing so has been harder, people culturally expected "use existing libraries" more than "just bundle everything", but as you note that attitude has shifted too and it always was possible, and nothing seriously suggested preventing it.

AnthonyMouse 1y ago

> They explicitly don't support installing any software not provided by their "app stores". Most Linux distributions don't prevent you from installing third party software at all. You download something, you set the execute bit, it runs. Users are wary of doing that with software from untrusted sources because, obviously, you're then placing your trust in whoever provided the software instead of the distribution's packaging team. But the OS won't stop you if that's what you want to do, and sometimes you do trust the source of the software. > Despite those policies, or perhaps because of them, botnets of Linux servers are common. Botnets of Linux servers are common because some people operate them without security installing updates (common with WordPress), and then attackers exploit known vulnerabilities in the unpatched software. But "locked" phone platforms regularly discontinue security updates for devices that are still in widespread use. Locking the device doesn't solve that problem at all, and in fact makes it worse because then if the OEM doesn't patch it nobody else can do it either.

mike_hearn 1y ago
You're conflating "allow" and "support". The OS doesn't stop you installing third party software - signed or not - on macOS, Windows or Android, so "allow" is nothing interesting. That also won't be changing with Android, given that you can buy a phone with an unlockable bootloader and reflash to some other spin of Android that implements whatever security policies you want. You can put these devices into a mode that allows anything. The question is whether that's something the vendors make easy, if they support it in the sense that you can do it and they will still deal with you if there's a problem. That's what support means. It's not a synonym for technically possible. Windows, macOS and Android don't consider installing third party software to put the system in an unsupported state. Linux vendors do.
- swiftcoder 1y ago
  This has not been true on macOS in some time - you have to go to considerable lengths to install unsigned software at this point. I recently upgraded macOS, and it took me a couple of reboots and scarily-worded system configuration changes to re-enable (signed) kernel extensions…

cherryteastain 1y ago

> They explicitly don't support installing any software not provided by their "app stores". Nonsense. You can and run install whatever you want. Tons of closed source commercial software available for Linux like Matlab come as a .tar file which you extract and run.

mattdm 1y ago
In Fedora, we don't "support" third-party packages or installation of software because we can't do much about it if something is wrong. You should go to the provider of the software for help. But we certainly support your _ability_ to install and run whatever you want. It's your computer, and it's your OS.
- mike_hearn 1y ago
  Regardless of the party line, in practice there's no big distinction between not caring if it works or not and not allowing it. The difference only matters for highly technical people with lots of time on their hands. For everyone else, if it's not a paved road it's not a road they can travel on at all, and so in practice Linux historically did not "support" third party software in any meaningful way. And although I was making that argument to Fedora decades ago, it's only recently that this point has been accepted with official support by Red Hat for stuff like Flatpak. Of course other distros developed their own thing as always so it's still not really ideal. But at least the principle was now accepted that third party apps should have a properly supported way to thrive. Far too late, but it's done.

guimplen 1y ago

This is so blatantly wrong. On macs it became a little bit hrder very recently (you need to tick a checkmark in the system setting to allow untrusted program running) otherwise you just need to run the program once via right-click. On most user-friendly linux distros you can just run installer of any program.

swiftcoder 1y ago
It’s a lot harder than that now in macOS - now you have to individually approve each new unsigned binary through the system preferences security panel.

Der_Einzige 1y ago

How can you be so aggressively wrong about so many things in a single post? It’s impressive. The stuff about Linux not letting you install stuff flies far in the face of like everyone’s knowledge of Linux. Your description of how Linux installation works is pure fantasy.

mike_hearn 1y ago
I didn't say it didn't "let" you. I said it's not supported, as in, the Linux vendors don't consider that to be a feature of the OS that you should actually use. I've been a Linux user for 25 years. You can reconfigure the OS to use additional repositories. It may or may not work, and only if there is a repository specific to both your distro and its version. But it's not a good idea. In particular, OS upgrades are very likely to break. Being able to upgrade itself is a basic requirement of any modern OS. If your Linux distro corrupts itself on upgrade or fails to do so and you file a bug report you'll be told to remove any third party software because that's not supported. This would be like if your Mac started crashing on boot because you downloaded a word processor from a website, and then Apple say "sorry, we only support apps coming from the app store". They don't do that, but Red Hat or Canonical will.

engeljohnb 1y ago

> They explicitly don't support installing any software not provided by their "app stores". Getting into those requires giving up your source code to them, and they reserve the right to modify it as they see fit without informing anyone I've used Ubuntu, Debian, Manjaro, Mint, and Fedora, and none of them are like this. Which distro do you use that doesn't let you install any software you want?