4 ms·

<OT> Out of curiosity, since you consider yourself a possible target for security agencies, do that affect your choice of OS? Do you use commercial operating s

by atmosx 13y ago

<OT> Out of curiosity, since you consider yourself a possible target for security agencies, do that affect your choice of OS? Do you use commercial operating systems like Windows and Mac or just open source software? </OT>

secfirstmd 13y ago
Well this could end up being a whole essay... I would say that generally it depends on the threat model and risk versus potential adversary (some African states would be different to China in capabilities etc). I think also a big part is really internalising and enforcing the idea that you will be breached at some point and acting accordingly, to minimise the data lose and be able to recover. So for example, if your only doing low risk stuff then the convenience of something like Windows/Mac and normal email service outweighs any risks from a breach (as long as you know how to access risk correctly and take the sensible/basic precautions). However for higher risk stuff then generally open-source solutions can potentially offer more security (too many to mention but tons of good ones here - Tails, TOR etc: https://prism-break.org/‎ https://prism-break.org/‎). I would caveat though that I am not someone who always drink the open-source koolaid all of the time. I think the recent Heartbleed and suspicions about TrueCrypt goes to show that occasionally we are make assumptions about the security of these tools based on a false sense of security. Proper security is a longer process of peer review, code audits etc that everyone kind of just takes for granted are done with open-source projects. Sometimes I think it's a little bit like the "free rider" problem, were everyone (including so many in relation to OpenSSL) is happy to use the tool but don't want to spend time/money/brainpower looking, adding, reviewing the underlying code. Then we get a lot of myths emerging (TrueCrypt is very safe for example - that might be the case but has it really been audited yet? Also, who is doing the auditing? etc). Obviously the fact that open source stuff is free and the code can be looked at and eventually fixed is a very good thing. Also, usability is a security feature and I think some of the secure open-source alternatives have problems in this area - though the work of the Guardian Project, Whisper Systems etc is doing a great job of fixing this aspect of things. Apologies if I got a bit sidetracked on this answer. If there is more specific advice you want, drop me a mail to the email (low risk stuff only) in my profile.
- atmosx 13y ago
  Okay, so I guess the answer to my question is: "I do use commercial operating systems". The rest is common knowledge to the #HN crowd I guess, but the thanks for taking the time to write a long answer.
  - secfirstmd 13y ago
    "I do use commercial operating systems". Sometimes and opensource other times :)
- dobbsbob 13y ago
  Tails is still using squeeze, refuses to patch their kernel with GrSec/PaX, and hasn't updated the release since March so a dozen known Debian security advisories are not patched including heartbleed. I wouldn't use it, it took them years to even add a macchanger on boot for wireless
  - lambda 13y ago
    Squeeze isn't vulnerable to heartbleed; the OpenSSL version is too old; heartbeat was introduced in 1.0.1, while Squeeze ships 0.9.8o.
    - dobbsbob 13y ago
      https://packages.debian.org/squeeze/openssl https://packages.debian.org/squeeze/openssl Oops, the strange decisions at Tails saves the day. I still don't understand their reluctance to patch grsecurity and/or pax. It's been on their roadmap for ages. Liberte Linux included it since their first release too bad the guy abandoned the project last year. Probably the same thing happened to Maxim as the creators of Anonym.OS they were hired to make secure builds for companies and stopped maintaining them. Of course anybody here can roll their own live distro of BSD/Nix and just review both projects design documents to see the kinds of security decisions made to implement them as well but the vast public is stuck with Tails which keeps ballooning in size. They need a light version without tons of codecs and video editing software, collaborative editors or full office suites.

by atmosx 13y ago

secfirstmd 13y ago

Well this could end up being a whole essay... I would say that generally it depends on the threat model and risk versus potential adversary (some African states would be different to China in capabilities etc). I think also a big part is really internalising and enforcing the idea that you will be breached at some point and acting accordingly, to minimise the data lose and be able to recover. So for example, if your only doing low risk stuff then the convenience of something like Windows/Mac and normal email service outweighs any risks from a breach (as long as you know how to access risk correctly and take the sensible/basic precautions). However for higher risk stuff then generally open-source solutions can potentially offer more security (too many to mention but tons of good ones here - Tails, TOR etc: https://prism-break.org/‎ https://prism-break.org/‎). I would caveat though that I am not someone who always drink the open-source koolaid all of the time. I think the recent Heartbleed and suspicions about TrueCrypt goes to show that occasionally we are make assumptions about the security of these tools based on a false sense of security. Proper security is a longer process of peer review, code audits etc that everyone kind of just takes for granted are done with open-source projects. Sometimes I think it's a little bit like the "free rider" problem, were everyone (including so many in relation to OpenSSL) is happy to use the tool but don't want to spend time/money/brainpower looking, adding, reviewing the underlying code. Then we get a lot of myths emerging (TrueCrypt is very safe for example - that might be the case but has it really been audited yet? Also, who is doing the auditing? etc). Obviously the fact that open source stuff is free and the code can be looked at and eventually fixed is a very good thing. Also, usability is a security feature and I think some of the secure open-source alternatives have problems in this area - though the work of the Guardian Project, Whisper Systems etc is doing a great job of fixing this aspect of things. Apologies if I got a bit sidetracked on this answer. If there is more specific advice you want, drop me a mail to the email (low risk stuff only) in my profile.

atmosx 13y ago
Okay, so I guess the answer to my question is: "I do use commercial operating systems". The rest is common knowledge to the #HN crowd I guess, but the thanks for taking the time to write a long answer.
- secfirstmd 13y ago
  "I do use commercial operating systems". Sometimes and opensource other times :)
dobbsbob 13y ago
Tails is still using squeeze, refuses to patch their kernel with GrSec/PaX, and hasn't updated the release since March so a dozen known Debian security advisories are not patched including heartbleed. I wouldn't use it, it took them years to even add a macchanger on boot for wireless
- lambda 13y ago
  Squeeze isn't vulnerable to heartbleed; the OpenSSL version is too old; heartbeat was introduced in 1.0.1, while Squeeze ships 0.9.8o.
  - dobbsbob 13y ago
    https://packages.debian.org/squeeze/openssl https://packages.debian.org/squeeze/openssl Oops, the strange decisions at Tails saves the day. I still don't understand their reluctance to patch grsecurity and/or pax. It's been on their roadmap for ages. Liberte Linux included it since their first release too bad the guy abandoned the project last year. Probably the same thing happened to Maxim as the creators of Anonym.OS they were hired to make secure builds for companies and stopped maintaining them. Of course anybody here can roll their own live distro of BSD/Nix and just review both projects design documents to see the kinds of security decisions made to implement them as well but the vast public is stuck with Tails which keeps ballooning in size. They need a light version without tons of codecs and video editing software, collaborative editors or full office suites.