Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is the Linux Desktop less secure than Windows 10? [pdf]

fosdem.org

Post reply on HN
Print view View original

51–60 of 190 posts

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#51

Post by jstanley »

CJefferson wrote: post #4

I believe in sandboxing, I hope it gets better and easier to use. I work on several C programs. I wish for the day when we have an easy to use, cross platform method of setting up a small set of open files at the start of a program, then be able to say "No more file access, no more network connections". I know this hides a whole bunch of complication, which is why it's hard and why there are so many ways to do it --…

> "No more file access, no more network connections".

You could potentially use setrlimit on RLIMIT_NOFILE to limit your number of open files.

Although... you probably still want to display something to the terminal which means you still want stdout and stderr, so an attacker could just close stdout and stderr before doing whatever they wanted with their 2 remaining fds.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#52

Post by bigbugbag »

xpaulbettsx wrote: post #6

I mean, the answer is unequivocally, without the slightest doubt, yes. The Linux Desktop is probably a good 5-10yrs behind Windows 10 in terms of defense-in-depth mitigations as well as exploits in common targets like file parsers etc etc. https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W... is a good reference for all the stuff that Desktop Linux in 2017 is for the most part, missing

There is no unequivocally answer in the domain of security, secure refers to a threat model.

When your threat model includes Microsoft or US surveillance then no Microsoft OS can provide you the security you're aiming for.

Then again Desktop Linux is no OpenBSD or GRsecurity[1], A hardened linux experience usually doesn't come out of the box with Desktop Linux, but still there are options to explore[2] if you're so inclined.

[1]: https://grsecurity.net/ [2]: https://wiki.archlinux.org/index.php/Security

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#53

Post by the8472 »

CJefferson wrote: post #4

I believe in sandboxing, I hope it gets better and easier to use. I work on several C programs. I wish for the day when we have an easy to use, cross platform method of setting up a small set of open files at the start of a program, then be able to say "No more file access, no more network connections". I know this hides a whole bunch of complication, which is why it's hard and why there are so many ways to do it --…

openbsd's pledge seems like an easy-to-use API.

on linux the low-level building blocks that can achieve similar are seccomp and namespaces, but the only abstractions that I am aware of involve separate launcher processes like runc[0] or firejail[1].

A library providing similar functionality to pledge that could be added during application startup or when doing fork+exec would be great.

[0] https://github.com/opencontainers/runtime-spec/blob/master/c... [1] https://firejail.wordpress.com/features-3/

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#54

Post by dchest »

qznc wrote: post #43

I'm irritated about the initial example, which targets "Ubuntu 12.04". Why this 5 year old version? Is it fixed already in newer ones? Because it will never be fixed for 12.04 and people are still using it?

Ubuntu 12.04 is supported until April 2017, so yes, it's still an "active" version, and security issues should be fixed.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#55

Post by AsyncAwait »

sytelus wrote: post #40
AsyncAwait wrote: post #12

Earlier quoted context omitted.

The thing with the Linux Desktop is that you can selectively enable SELinux, use PaX etc. and have security comparable to, if not better, than Windows 10, plus the fact that Linux is a much more varied attack surface still applies. Or you can do nothing, in which case you're probably less secure.

This is exactly the problem. You can buy Windows 10 machine and if it becomes vulnerable it's Microsoft's fault and you would count on them to fix it immediately, push out the automatic update and go on with your life. If default Linux desktop is insecure then consumer is supposed to figure out what exactly is insecure, be expert in knowing the alternatives and how to replace everything. The question isn't whether Li…

> you would count on them to fix it immediately, push out the automatic update and go on with your life.

Not only do you get security updates for your distro with the vast majority of Linux distros, but you also get it for all your 3rd party software, using the same system mechanism.

They may not push the updates automatically, (you can of course set it that way), but some of us still want to be in control of what gets installed on our machines

That's not to say it can't be improved, but the situation isn't quite as bad as you are painting it, ie there are mainstream distros that come hardened by default and security patches are regularly backported.

I'd argue that macOS is also technologically less secure than modern Windows, yet its users are in no more danger than Windows users are, (despite its theoretically security), because security depends on a lot of factors including the user culture, market share etc. i.e. Linux doesn't have a culture of downloading executables from random websites for one.

I'd guess most distributions feel like they're providing an adequate level of protection for their users as of now, without introducing too much friction. Once that is no longer the case, it's easy to turn on a few more knobs, the software is already there.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#56

Post by nottorp »

davidp wrote: post #44
nottorp wrote: post #39

Earlier quoted context omitted.

Video? What happened to good old fashioned text? I can read 10x faster than you can talk...

Yeah, screw that guy for offering free quality content in video form, AND the nicely written text piece you just asked for.

Where is it? The PDF has some slides, not actual text, and the LWN article is also just a summary.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#57

Post by MohammadLee »

xpaulbettsx wrote: post #6

I mean, the answer is unequivocally, without the slightest doubt, yes. The Linux Desktop is probably a good 5-10yrs behind Windows 10 in terms of defense-in-depth mitigations as well as exploits in common targets like file parsers etc etc. https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W... is a good reference for all the stuff that Desktop Linux in 2017 is for the most part, missing

Now imagine what a Linux distribution could achieve with the same budget...

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#58

Post by rimantas »

general_ai wrote: post #28

There's security and there's safety. Linux desktop may well be less secure, meaning that it could be successfully attacked by an experienced attacker. At the same time it's far less likely to be attacked, so it's safer, for the same reason as macOS: less marketshare, few people are motivated to learn/research attack vectors.

Once again: Mac OS in pre-X days had even smaller market share, but many many more viruses in the wild. It's not all about the market share.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#59

Post by Nursie »

SwellJoe wrote: post #41

It's interesting that the problems are all with things that I actively dislike about the modern Linux desktop. I mean, I guess it's OK that it creates thumbnails of images...but, the tendency to grind away for seconds whenever opening a big folder (Windows does it, too, I guess) is just annoying. I end up using command line most of the time for file management tasks because it's too slow and cumbersome to use the UI.…

I was just thinking much the same - these things are a good reason to keep to minimal desktop environments and full control of the system.

My only interaction with "Tracker" has been to figure out how to disable it and get it off the system, as it was doing god-knows what and pegging processors. I can (and do) happily exist without apport.

I know this doesn't make me safe per se, but I do think that in becoming more windows-like and 'integrated' we end up with these unintended consequences.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#60

Post by bkor »

xorcist wrote: post #42

When this metadata indexing was introduced in gnome/kde many users complained, because it pegged their cpu and was really unasked for. But some felt that this was something the MacOSX had and therefore some developers felt it was a good default. I'm not convinced, partly because of the increased attack surface. The desktop environment itself is but a small part of the complete desktop. Some important differences betw…

Showing dialogs is not a solution. Various studies have already shown users click any dialog which pops up without actually reading the dialog.

Loads of browsers do download automatically. Making things inconvenient and delegating security decisions to the user isn't good enough. Make it convenient and secure!

PS/Edit: Btw, under Windows 10 loads of things are indexed. It makes things very convenient. You use your pc like Google. Instead of knowing exactly where things are you just "Google" for it. With that I mean it has a good working search that's also really quick in giving accurate results.

Post reply on HN