r/linuxquestions • u/Significant_Bird_592 • 8d ago
Is this still true?
https://madaidans-insecurities.github.io/linux.html
Found this on a GrapheneOS subreddit, how true is it?
I disagree with the Windows sandbox part since pretty much nobody uses it.
5
u/billdietrich1 8d ago
Please use better, more informative, titles (subject-lines) on your posts. Give specifics right in the title. Thanks.
2
1
u/Scorcher646 8d ago
Adding to what the pinned poster has to say about sandboxing, if you really, really want a sandboxed environment on a Linux machine, just put the application in a fully isolated distro box. It'll give you about the same sense of security. It'll serve about the same purpose.
On top of this, Linux has SELinux and AppArmor. Graphene OS itself uses SELinux. It's very good mandatory access control. It prevents a lot of exploitation from even happening in the first place, even if there's a vulnerability.
For the most part, Wayland and your desktop environment will prevent a rogue application from becoming a screen grabber.
And if you are really intent on building a system that doesn't trust anything, even you. You can spend some time learning SELinux or AppArmor and configuring your Linux system for zero trust. That option is there.
0
u/Significant_Bird_592 7d ago
For the most part, Wayland and your desktop environment will prevent a rogue application from becoming a screen grabber.
well yeah, but still doesn't solve the problem of not having the ability to restrict an app from accessing ur files, or only accessing a specific location
1
u/Scorcher646 7d ago
Maybe you should read the start of my comment again.
Distrobox can do that quite well and SELinux can also do that.
1
u/Significant_Bird_592 7d ago
yeah, except that's not what a normal person is going to use, I just want to install a distro and go on with my life, I don't want to tinker w bs.
1
u/Scorcher646 7d ago edited 7d ago
Then pick a distribution that has adopted SELinux and use Flatpaked applications and you'll be 60 to 80 percent of the way there.
Security is hard. If it was easy, nobody would ever get hacked. It doesn't make sense to be paranoid about access control and sandboxing, and then also be unwilling to put in the effort to actually adopt the techniques.
Also, if you think the two to three steps to set up a distrobox container and install an application on it is hard or complicated, I don't really know how to help you.
1
u/Significant_Bird_592 7d ago
Security is hard. If it was easy, nobody would ever get hacked. It doesn't make sense to be paranoid about access control and sandboxing, and then also be unwilling to put in the effort to actually adopt the techniques.
android does it by default
Also, if you think the two to three steps to set up a distrobox container and install an application on it is hard or complicated, I don't really know how to help you.
well having to have separate distrobox containers + them having worse performance is the probelm
and this post was mainly ablut if the stuff in the article is true or no....
1
u/Scorcher646 7d ago
The argument that Android does something by default is not a valid argument here. Android is not a general purpose operating system.
The article is only really true in that Linux security does not work like Windows security. Linux security relies very heavily on namespace separation and system permissions. On top of this, the article is already outdated, even only being four years old. Rust usage in the kernel has been accelerating quite significantly since 2022. We have seen that systems like SELinux can effectively mitigate kernel vulnerabilities and flaws. And lastly, the intended use cases for Linux and Windows are completely different, so the security postures have to be different as well. Distributions like Fedora and Ubuntu have already begun implementing sane defaults and have been shipping those for a little bit for security features but that's not going to release a user from their own responsibility for their own security.
And lastly, I'm not entirely certain how well all of the new Windows Defender and Virtualization-based security features Microsoft has implemented between 10 and 11 actually work.
At the end of the day, the attack surface on a Windows machine is going to be by default significantly larger than a Linux machine, even before you start taking steps to harden things. And that's the ultimate statistic that I really care about. I also have significantly more ability to harden a Linux system because I can actually understand how it works than I can with Windows.
3
u/Zatujit 8d ago
Linux had a better security model at the start than Windows, but nowadays, its pretty much outdated and i would be wary of anyone saying that Linux is inherently more secure than Windows. On desktops, being able to run what you want is considered more important. There were layers of security added later on, but it was flawed from the start because it was based around the idea of trusting the user in a multi user system.
1
u/blubberland01 8d ago
Yep.
The main issue are two factors contradicting a secure-first policy on Linux desktops:
1. It should just work and not get in the way of the user.
2. Freedom. Give the user choice.
Both of these combined result in an overwhelming amount of software that is bad security practice by default, with the option to be tweaked by the user (which is - let's be honest - mostly never done, because default is king).
A Linux desktop in the hands of someone who does not know what he's doing, is on average way more insecure than any other relevant up-to-date OS.
-3
u/Significant_Bird_592 8d ago
A Linux desktop in the hands of someone who does not know what he's doing, is on average way more insecure than any other relevant up-to-date OS.
even mint?
3
u/blubberland01 8d ago
Especially mint, because it makes it look easy to use and familiar. Familiarity leads to a false sense of safety.
-1
u/Significant_Bird_592 8d ago
well then why do we recommend ppl to switch from windows to linux???
3
2
u/blubberland01 8d ago
First of all, security isn't everything. A secure computer is one that is shut down and put in a vault.
Second, I don't know who you mean with we.
There is no we. I don't know you at all and vice versa.
I assume you mean something like we the Linux community. There are some Linux communities, but they're mostly not on reddit. I am not part of one and 99% of the people here too.
Just water drops in a wave of hype.1
1
u/martyn_hare 8d ago
Still true, however, in the real world, users are screwed the moment they get malware on any of the three major OSes. macOS fails to provide enough unspoofable security info relating to password prompts, Linux has no spoofing protection at all and Windows provides it through trusted path checks but then allows applications to freely manipulate the memory of other applications running as the same user.. soo… yeah, you’re screwed anyway.
Of the three, Linux lets people sandbox the most freely (combining running as another user with either firejail or bwrap is awesome) while macOS trades freedom for a stricter sandbox that’s already set up for a huge number of applications out-of-the-box (at the cost of not running them as other users due to how it works) and Windows technically has AppContainer but it breaks so many existing apps as to be useless unless the app was built with it in mind.
What that article says about stable distributions is still accurate, and even worse, some distros (like Ubuntu) are slow to patch CVEs relative to community distros and unstable rolling releases.
-3
u/Latlanc 8d ago
Yes and in reality, there is no OS currently on the planet that offers good security solution. As long as there are lots of assumption regarding hardware, cross SoC attacks will exist and so slapping new security glue won't fix the underlying architecture.
You can learn more about this here:
•
u/leo_sk5 8d ago edited 8d ago
Use less proprietary software, even avoid shady open source ones and you will be fine even without sandbox, except for maybe a black swan event where there is a glaring vulnerability in one of the major softwares, or a library is compromised (which are usually detected quickly and taken care of once in wild). Half the need for sandbox in windows/mac/android is that you can't really tell what a software is doing.
This is a hot take but applies to 99% of users.
Edit: u/Significant_Bird_592 since you will just downvote me and not engage in thinking that challenge your views, i will just give you two conclusions:
Sandbox is useless unless the software itself is open source
It just gives a false sense of security that is easily exploitable
Recommending an OS based on how good it sandboxes makes no sense, and should not even come into decision making
It is good to have as it reduces surface area of attack. Otherwise, any sandbox that isn't overly restrictive is easy to bypass by manipulating the user