3 ms·

As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very diff

As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers. Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine. Dumping crap all over C:\Windows or /usr or /boot or something? No way--the OS should make the developer obtain my consent (not just a blanket sudo-like escalation) to do these things. Sneakily modifying /etc/hosts to act against me? Get the hell outta here!

mikkupikku 7mo ago
I thought the days if needing to "sudo" to install applications on windows were long gone; doesn't basically everything happily do user installations now? I would view a demand to escalate as basically proof that the application is about to do something janky, if not outright malicious. On linux, if I can't build and run software with just my user account, that software has some explaining to do. Virtually every desktop application should be able to run without escalated privileges.
- Ajedi32 7mo ago
  "C:/Program Files" is still the recommended place to install programs, and it requires admin privileges to write to. Some programs (ab)use C:\ProgramData for that purpose instead and therefore don't need admin privliges. But even with that hack, ultimately Windows still uses the https://xkcd.com/1200/ https://xkcd.com/1200/ permission model. (Everything runs with full access to all your data.)
  - TiredOfLife 7mo ago
    On Windows enabling access control is 4 clicks. The problem with enabling it by default is that every time MS tries to harden the defaults there is much weeping and wailing and gnashing of teeth
- vpShane 7mo ago
  on windows and mac they just get a prompt and a lot of people don't read it, care, nor wonder what it's actually doing they just want it to work. I know you all know this but companies will do this knowing that exploiting all of us. I use Linux and agreed on all those points. when I used adobe before it wanted to charge me a fee to cancel my subscription and wouldn't let me just 'cancel' in their system so I just blocked the payments on my card and dipped out. good software, garbage company
  - amarant 7mo ago
    Heh, I had a similar situation once, but my bank wouldn't let me block the transactions. So I switched banks. It was a interesting call with my previous banks support folks.
  - TiredOfLife 7mo ago
    On linux they just use sudo and similary don't read, care or wonder.
- TacticalCoder 7mo ago
  > On linux, if I can't build and run software with just my user account, that software has some explaining to do. Yup same. The software I install as root are those shipping stock with the distro. Others I compile and run from user accounts (like Emacs, which I always compile from source).
- Dylan16807 7mo ago
  Your impression is pretty far off, I think. Just naming a program setup.exe makes it escalate by default. Many installers can be used without escalation but going the traditional path isn't suspicious.
armadyl 7mo ago
> As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers. Funny enough macOS, iOS, iPadOS and Android do this and they are constantly attacked for it. I do think there needs to be more strict adherence by developers to standards like XDG but I don’t know how it could be enforced.
- nulld3v 7mo ago
  They are constantly attacked because they prevent users from modifying the system configuration, not just app developers.
  - simondotau 7mo ago
    From the operating system’s perspective, everything is the user. Or everything is an app developer. Depends on perspective. Disambiguating reliably, in a way you’d consider reasonable, is not trivial (and arguably impossible).
    - nulld3v 7mo ago
      I'm not sure I fully understand you. All those OSes try very, very hard to disambiguate between apps and the user itself?
      - lmz 7mo ago
        A program touches a system file. Is it due to its own logic, or is it your editor saving a file?
      - simondotau 7mo ago
        Pretend you’re the operating system for a moment. What does “the user” look like, if not an app doing things?
    - Dylan16807 7mo ago
      Phone-style isolation is more like giving each app a separate user account. With that level of isolation and robust permissions, apps can do very little "on your behalf".
inetknght 7mo ago
> Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine. I used to have this opinion too. Then I decided that I actually don't want random things to install to `/usr/local/bin`. They should install to `${HOME}/.local/bin`. I should be perfectly capable of installing any application without modifying the system for every user.
- lmm 7mo ago
  You should have that option, but you should also be able to install things for all users. That's a pretty common case - most of the time if you install something on your computer, you are the administrator of that computer and want the thing you installed to be available for all users of that computer.
  - inetknght 7mo ago
    > most of the time if you install something on your computer, you are the administrator of that computer and want the thing you installed to be available for all users of that computer Speak for yourself. For installing via system packages, yes. Otherwise absolutely no. Most of the time if I install something on my computer without using the package manager, I am the administrator of that computer and I want the thing I installed to be available to a specific run-user, not to all users.
    - Dylan16807 7mo ago
      > Speak for yourself. For installing via system packages, yes. Otherwise absolutely no. That's an overly strong rebuttal given they said "most" and weren't talking about a specific style of install.
    - tremon 7mo ago
      > I am the administrator of that computer and I want the thing I installed to be available to a specific run-user Are you saying you use root access to install something to a specific user's home directory? That's gross. A user installing something for themselves should not need administrator access. You only need admin access for making system-wide changes.
dev_l1x_be 7mo ago
> developers should not have free rein to modify my system's configuration s/free rein/the ability/ I am a big believer in read only operating systems. /etc should not be writable.
- zymhan 7mo ago
  We get it, you like Nix
  - dev_l1x_be 7mo ago
    Nix has some good ideas but it is not exactly what I would love to have.
  - Shebanator 7mo ago
    NixOS is not a read only OS. There is an impermanence addon that can do this, though, for many partitions.
- Dylan16807 7mo ago
  How do you configure things without something basically equivalent to writing to /etc? And whatever you do use to configure things, what if photoshop accessed it directly? I'm sure you'd be upset with that even if it didn't touch /etc.
  - dev_l1x_be 7mo ago
    If something is system wide i want a commit based workflow (with minor exceptions like dhcp / ip) Everything else should be in its own folder without the ability to change anything outside of that folder.
    - Dylan16807 7mo ago
      Well my point is that switching to a commit-based workflow with no runtime changes doesn't solve the problem of adobe setup including a malicious commit. Isolating things to a specific folder is what actually gives any security here, and you can do that on a writable /etc too.
qq66 7mo ago
This is why I love iOS in many ways: it's very difficult for an app to have "action at a distance" inside your OS. If you force-quit the app it's pretty much like it never existed.
mhh__ 7mo ago
I won't name names just in case I'm misremembering but I'm pretty sure a remote desktop program you've heard at one point was adding a global LD_PRELOAD and pointing it at a shared library that anyone could write to. But I might be making this up so not being specific lest I do a cheeky libel
massysett 7mo ago
Meet macOS System Integrity Protection. Even root can’t do some things. Some hate it, I love it and would never turn it off. I know some parts of my system haven’t been gunked up by random vendors. https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection
anal_reactor 7mo ago
The problem is that you have 100 apps that want to overwrite system files for malware reasons and then you have 1 app that wants to do it for legit reasons and there's no blanket method to tell these two situations apart.
jbverschoor 7mo ago
They can have all the root they want In a sandbox or vm

mikkupikku 7mo ago

I thought the days if needing to "sudo" to install applications on windows were long gone; doesn't basically everything happily do user installations now? I would view a demand to escalate as basically proof that the application is about to do something janky, if not outright malicious. On linux, if I can't build and run software with just my user account, that software has some explaining to do. Virtually every desktop application should be able to run without escalated privileges.

Ajedi32 7mo ago
"C:/Program Files" is still the recommended place to install programs, and it requires admin privileges to write to. Some programs (ab)use C:\ProgramData for that purpose instead and therefore don't need admin privliges. But even with that hack, ultimately Windows still uses the https://xkcd.com/1200/ https://xkcd.com/1200/ permission model. (Everything runs with full access to all your data.)
- TiredOfLife 7mo ago
  On Windows enabling access control is 4 clicks. The problem with enabling it by default is that every time MS tries to harden the defaults there is much weeping and wailing and gnashing of teeth
vpShane 7mo ago
on windows and mac they just get a prompt and a lot of people don't read it, care, nor wonder what it's actually doing they just want it to work. I know you all know this but companies will do this knowing that exploiting all of us. I use Linux and agreed on all those points. when I used adobe before it wanted to charge me a fee to cancel my subscription and wouldn't let me just 'cancel' in their system so I just blocked the payments on my card and dipped out. good software, garbage company
- amarant 7mo ago
  Heh, I had a similar situation once, but my bank wouldn't let me block the transactions. So I switched banks. It was a interesting call with my previous banks support folks.
- TiredOfLife 7mo ago
  On linux they just use sudo and similary don't read, care or wonder.
TacticalCoder 7mo ago
> On linux, if I can't build and run software with just my user account, that software has some explaining to do. Yup same. The software I install as root are those shipping stock with the distro. Others I compile and run from user accounts (like Emacs, which I always compile from source).
Dylan16807 7mo ago
Your impression is pretty far off, I think. Just naming a program setup.exe makes it escalate by default. Many installers can be used without escalation but going the traditional path isn't suspicious.

armadyl 7mo ago

> As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers. Funny enough macOS, iOS, iPadOS and Android do this and they are constantly attacked for it. I do think there needs to be more strict adherence by developers to standards like XDG but I don’t know how it could be enforced.

nulld3v 7mo ago
They are constantly attacked because they prevent users from modifying the system configuration, not just app developers.
- simondotau 7mo ago
  From the operating system’s perspective, everything is the user. Or everything is an app developer. Depends on perspective. Disambiguating reliably, in a way you’d consider reasonable, is not trivial (and arguably impossible).
  - nulld3v 7mo ago
    I'm not sure I fully understand you. All those OSes try very, very hard to disambiguate between apps and the user itself?
    - lmz 7mo ago
      A program touches a system file. Is it due to its own logic, or is it your editor saving a file?
    - simondotau 7mo ago
      Pretend you’re the operating system for a moment. What does “the user” look like, if not an app doing things?
  - Dylan16807 7mo ago
    Phone-style isolation is more like giving each app a separate user account. With that level of isolation and robust permissions, apps can do very little "on your behalf".

inetknght 7mo ago

> Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine. I used to have this opinion too. Then I decided that I actually don't want random things to install to `/usr/local/bin`. They should install to `${HOME}/.local/bin`. I should be perfectly capable of installing any application without modifying the system for every user.

lmm 7mo ago
You should have that option, but you should also be able to install things for all users. That's a pretty common case - most of the time if you install something on your computer, you are the administrator of that computer and want the thing you installed to be available for all users of that computer.
- inetknght 7mo ago
  > most of the time if you install something on your computer, you are the administrator of that computer and want the thing you installed to be available for all users of that computer Speak for yourself. For installing via system packages, yes. Otherwise absolutely no. Most of the time if I install something on my computer without using the package manager, I am the administrator of that computer and I want the thing I installed to be available to a specific run-user, not to all users.
  - Dylan16807 7mo ago
    > Speak for yourself. For installing via system packages, yes. Otherwise absolutely no. That's an overly strong rebuttal given they said "most" and weren't talking about a specific style of install.
  - tremon 7mo ago
    > I am the administrator of that computer and I want the thing I installed to be available to a specific run-user Are you saying you use root access to install something to a specific user's home directory? That's gross. A user installing something for themselves should not need administrator access. You only need admin access for making system-wide changes.

dev_l1x_be 7mo ago

> developers should not have free rein to modify my system's configuration s/free rein/the ability/ I am a big believer in read only operating systems. /etc should not be writable.

zymhan 7mo ago
We get it, you like Nix
- dev_l1x_be 7mo ago
  Nix has some good ideas but it is not exactly what I would love to have.
- Shebanator 7mo ago
  NixOS is not a read only OS. There is an impermanence addon that can do this, though, for many partitions.
Dylan16807 7mo ago
How do you configure things without something basically equivalent to writing to /etc? And whatever you do use to configure things, what if photoshop accessed it directly? I'm sure you'd be upset with that even if it didn't touch /etc.
- dev_l1x_be 7mo ago
  If something is system wide i want a commit based workflow (with minor exceptions like dhcp / ip) Everything else should be in its own folder without the ability to change anything outside of that folder.
  - Dylan16807 7mo ago
    Well my point is that switching to a commit-based workflow with no runtime changes doesn't solve the problem of adobe setup including a malicious commit. Isolating things to a specific folder is what actually gives any security here, and you can do that on a writable /etc too.

qq66 7mo ago

This is why I love iOS in many ways: it's very difficult for an app to have "action at a distance" inside your OS. If you force-quit the app it's pretty much like it never existed.

mhh__ 7mo ago

I won't name names just in case I'm misremembering but I'm pretty sure a remote desktop program you've heard at one point was adding a global LD_PRELOAD and pointing it at a shared library that anyone could write to. But I might be making this up so not being specific lest I do a cheeky libel

massysett 7mo ago

Meet macOS System Integrity Protection. Even root can’t do some things. Some hate it, I love it and would never turn it off. I know some parts of my system haven’t been gunked up by random vendors. https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection

anal_reactor 7mo ago

The problem is that you have 100 apps that want to overwrite system files for malware reasons and then you have 1 app that wants to do it for legit reasons and there's no blanket method to tell these two situations apart.

jbverschoor 7mo ago

They can have all the root they want In a sandbox or vm