Security

5014 readers

4 users here now

Confidentiality Integrity Availability

founded 4 years ago

MODERATORS

[email protected]

The right thing for the wrong reasons: FLOSS doesn't imply security (seirdy.one)

submitted 2 years ago by [email protected] to c/[email protected]

5 comments fedilink hide all child comments

I find people who agree with me for the wrong reasons to be more problematic than people who simply disagree with me. After writing a lot about why free software is important, I needed to clarify that there are good and bad reasons for supporting it.

You can audit the security of proprietary software quite thoroughly; source code isn't a necessary or sufficient precondition for a particular software implementation to be considered secure.

you are viewing a single comment's thread
view the rest of the comments

[+] [email protected] -3 points 2 years ago* (last edited 4 months ago) (4 children)

[removed by mod]

[–] [email protected] 0 points 2 years ago* (last edited 2 years ago) (3 children)

He is a security grifter that recommends Windows and MacOS over Linux for some twisted security purposes.

Windows Enterprise and macOS are ahead of Linux's exploit mitigations. Madaidan wasn't claiming that Windows and macOS are the right OSes for you, or that Linux is too insecure for it to be a good fit for your threat model; he was only claiming that Windows and macOS have stronger defenses available.

QubesOS would definitely give Windows and macOS a run for their money, if you use it correctly. Ultimately, Fuchsia is probably going to eat their lunch security-wise; its capabilities system is incredibly well done and its controls over dynamic code execution put it even ahead of Android. I'd be interested in seeing Zircon- or Fuchsia-based distros in the future.

When it comes to privacy: I fully agree that the default settings of Windows, macOS, Chrome, and others are really bad. And I don't think "but it's configurable" excuses them: https://pleroma.envs.net/notice/AB6w0HTyU9KiUX7dsu

I think you have gotten influenced by madaidan’s grift because you use a lot of closed source tools and want to justify it to yourself as safe.

Here's an exhaustive list of the proprietary software on my machine:

Microcode
Intel subsystems for my processor (ME, AMT is disabled. My next CPU hopefully won't be x86_64 because the research I did on ME and AMD Secure Technology gave me nightmares).
Non-executable firmware
Patent-encumbered media codecs with open-source implementations (AVC/H.264, HEVC/H.265). This should be FLOSS but algorithms are patented; commercial use and distribution can be subject to royalties.
Web apps I'm required to use and would rather avoid (e.g. the web version of Zoom for school).
Some Nintendo 3DS games I play in a FLOSS emulator (Citra). Sandboxed, ofc.

That's it. I don't even have proprietary drivers. I'm strongly against proprietary software on ideological grounds. If you want to know more about my setup, I've made my dotfiles available.

[+] [email protected] -3 points 2 years ago* (last edited 4 months ago) (2 children)

[removed by mod]

[–] [email protected] 0 points 2 years ago* (last edited 2 years ago) (1 children)

Servers use Linux

The server, desktop, and mobile computing models are all quite different. The traditional desktop model involves giving programs the same user privileges and giving them free reign over all a user’s data; the server model splits programs into different unprivileged users isolated from each other, with one admin account configuring everything; the mobile model gives programs private storage and ensures that programs can’t read each others’ data and need permission to read shared storage. Each has unique tradeoffs.

macOS has been adopting safeguards to sandbox programs with fewer privileges than what's available to a user account; Windows has been lagging behind but has made some progress (I'm less familiar with the Windows side of this). On Linux, all modern user-friendly attempts to bring sandboxing to the desktop (Flatpak and Snap are what I'm thinking of) allow programs opt into sandboxing. The OS doesn't force all programs to run with minimum privileges by default having users control escalating user-level privileges; if you chmod +x a file, it gets all user-level privileges by default. Windows is...somewhat similar in this regard, I admit. But Windows' sandboxing options--UXP and the Windows Sandbox--are more airtight than Flatpak (I'm more familiar with Flatpak than Snap, as I have some unrelated fundamental disagreements with Snap's design).

I think Flatpak has the potential to improve a lot: it can make existing permissions enabled at run-time so that filesystem-wide sandboxing only gets enabled when a program tries to bypass a portal (most of the "filesystem=*" apps can work well without it, and some only need it for certain tasks), and the current seccomp filter can be made a "privileged execution" permission with the default filters offering fine-grained ioctl filtering and toggleable W^X + W!->X enforcement. The versions of JavaScriptCore, GJS, Electron, Java, and LuaJIT used by runtimes and apps can be patched to run in JITless mode unless e.g. an envvar for "privileged execution" is detected. I've voiced some of these suggestions to the devs before.

My favorite (and current) distro is Fedora. If Flatpak makes these improvements, Fedora lands FS-verity in Fedora 37, Fedora lands dm-verity in Silverblue/Kinoite, and we get some implementation of verified boot that actually lets users control the signing key: I personally wouldn't consider Fedora "insecure" anymore. Though I'd still find it to be a bit problematic because of Systemd. I wasn't convinced by Madaidan's brief criticisms of Systemd; I prefer this series of posts that outlines issues in Systemd's design and shows how past exploits could have been proactively (instead of reactively) avoided:

Systemd exposes nice functionality and I genuinely enjoy using it, but its underlying architecture doesn't provide a lot of protections against itself. The reason I bring it up when distros like Alpine and Gentoo exist is that the distro I currently think best combines the traditional desktop model with some hardening--Fedora Silverblue/Kinoite--uses it.

QubesOS is based on Linux

QubesOS is based on Linux, but it isn't in the same category as a traditional desktop Linux distribution. Like Android and ChromeOS, it significantly alters the desktop model by compartmentalizing everything into Xen hypervisors. I brought it up to show how it's possible to "make Linux secure" but in doing so you'd deviate heavily from a standard distribution. Although Qubes is based on Linux, its devs feel more comfortable calling it a "Xen distribution" to highlight its differences from other Linux distributions.

Here’s an exhaustive list of the proprietary software on my machine:

This is a defeatist attitude and meaningless excuse.

I only brought this up in response to the bad-faith argument you previously made:

I think you have gotten influenced by madaidan’s grift because you use a lot of closed source tools and want to justify it to yourself as safe.

I don't use any closed-sourced tools on my personal machine beyone hardware support, emulated games, and webapps I have to run for online classes. Since you seem to be arguing in bad faith, I don't think I'll engage further. Best of luck.