3 ms·

>More so than, say, Windows? Really? significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls

>More so than, say, Windows? Really? significantly so. Windows has a coherent story when it comes to permissions and access. Differentiated out access controls, least privilege, UAC, mandatory integrity control and all configured out of the box. Without AppArmor or SElinux correctly configured, which it isn't on most desktop distributions in the linux world most of your apps can still read anything, there's little sandboxing. The NT Kernel was designed with an object model in mind so you always had the abilities to have rich descriptions and policies for whatever you're handling where all of that is bolted on unix systems after the fact.

charcircuit 3mo ago
>Windows has a coherent story when it comes to permissions and access. Yet that doesn't seem to matter much for stealer malware.
- Barrin92 3mo ago
  it does matter, things like the Data Protection API do meaningfully reduce what you can extract from a windows system. Of course Windows regardless has taken the brunt of the attacks because it ran virtually every desktop machine in the world so people go after users anyway. Desktop Linux systems where never economically interesting for malware. But now that they have gained a modicum of traction they're going to get the exact same treatment, hence this thread. Microsoft doesn't advertise it much but they do have the advantage of controlling their build environments, software is signed etc. A system like the AUR where you pull in unsigned packages from anonymous people with so many arch users relying on it is not going to be easy to address. It lived on security through obscurity.
  - charcircuit 3mo ago
    >Data Protection API do meaningfully reduce what you can extract from a windows system It's not meaningfully reduced. The stealer just has to call CryptUnprotectData before uploading it. It's not even like it will show a suspicious prompt to the user, without having to do anything extra the stealer can silently decrypt it. I agree with the rest of the post though.
preg_match 3mo ago
I would say most Linux desktops users are aggressively sandboxing everything. All my dev envs are sandboxed, trivially, Claude is sandboxed, and all my apps are flatpak. And I do actually revoke permissions for flatpaks often, although most are real good about it - using xdg-directory and such. Maybe I’m a minority, but the tools are very mature and easy to use IMO. In windows land people are still installing random EXEs, that’s the reality.

charcircuit 3mo ago

>Windows has a coherent story when it comes to permissions and access. Yet that doesn't seem to matter much for stealer malware.

Barrin92 3mo ago
it does matter, things like the Data Protection API do meaningfully reduce what you can extract from a windows system. Of course Windows regardless has taken the brunt of the attacks because it ran virtually every desktop machine in the world so people go after users anyway. Desktop Linux systems where never economically interesting for malware. But now that they have gained a modicum of traction they're going to get the exact same treatment, hence this thread. Microsoft doesn't advertise it much but they do have the advantage of controlling their build environments, software is signed etc. A system like the AUR where you pull in unsigned packages from anonymous people with so many arch users relying on it is not going to be easy to address. It lived on security through obscurity.
- charcircuit 3mo ago
  >Data Protection API do meaningfully reduce what you can extract from a windows system It's not meaningfully reduced. The stealer just has to call CryptUnprotectData before uploading it. It's not even like it will show a suspicious prompt to the user, without having to do anything extra the stealer can silently decrypt it. I agree with the rest of the post though.

preg_match 3mo ago

I would say most Linux desktops users are aggressively sandboxing everything. All my dev envs are sandboxed, trivially, Claude is sandboxed, and all my apps are flatpak. And I do actually revoke permissions for flatpaks often, although most are real good about it - using xdg-directory and such. Maybe I’m a minority, but the tools are very mature and easy to use IMO. In windows land people are still installing random EXEs, that’s the reality.