Live data from Hacker News

Is the Linux Desktop less secure than Windows 10? [pdf]

fosdem.org

131–140 of 190 posts

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#131
post #35

Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"? Is it easier to change your media player on Linux, or to trust Microsoft? Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?

This title is pure sensationalism. The written piece says clearly "security vulnerabilities in the GStreamer multimedia framework. A combination of the Chrome browser and GNOME-based desktops creates a particularly scary vulnerability.". Somehow this very specific combination inflated to become Desktop Linux.

My default installation came with VLC, firefox and KDE. No gstreamer nor gnome installed, google products including Chrome are not welcome. Though I'm pretty sure manjaro is part of the Desktop Linux family.

Too bad this misrepresentation is hurting the message OP is trying to carry to the world. Then this message is hardly news, the guys at grsecurity have been at it for 15 years providing hardening security patches to the vanilla kernel.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#132

Earlier quoted context omitted.

'locate' is 35 years old. And has been available on linux desktops since 1991. Just saying.

Hasn't it been replaced by slocate, mlocate, tlocate or another variant since ?

Yes, and there were a few implementations from different groups, as you would expect. I'm typing this on a current Arch and locate, mlocate and slocate are all available from the mlocate package.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#133

Earlier quoted context omitted.

> Windows does it, too, I guess No, it generates thumbnails outside the main UI thread; sometimes it's a bit slow in so doing, but I've never seen it hang an Explorer window, regardless of file size or quantity. (Windows 7, but it would astonish me to learn that 10 displays a regression here.)

That's not the problem, most DE file managers use an external process too (via dbus), but it's still slow, even on an SSD or when the cache has alredy been generated. They're also buggy, XFCEs thumbnailer thumblerd (also used in LXDE and probably others) used to have memory leaks when it encountered video files with unknown codecs, newer versions re-scan the entire cache every time you delete/move a directory, making…

The rox video thumbnailer is basically a script that runs ffmpeg to extract the first keyframe or some such.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#134
post #3

Important bit is on the later slides: Issues on most codecs/parsers can be prevented by sandboxing. An exploding parser should never affect other processes, files, etc. Seccomp (bpf version) is only available since 2012 really, but I hope more apps will start picking it up. It's pretty simple it should become a shameful thing not to use it in new apps.

No need to wait, you can sandbox your applications now: https://wiki.archlinux.org/index.php/Security#Sandboxing_app...

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#135

It's interesting that the problems are all with things that I actively dislike about the modern Linux desktop. I mean, I guess it's OK that it creates thumbnails of images...but, the tendency to grind away for seconds whenever opening a big folder (Windows does it, too, I guess) is just annoying. I end up using command line most of the time for file management tasks because it's too slow and cumbersome to use the UI.…

Just a small comment on why the desktop environment might need to parse such a file: How about sorting music files according to their real length? Many desktop environments support such a feature, and users like those features, too.

And they need to do this, why?

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#136
post #35

Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"? Is it easier to change your media player on Linux, or to trust Microsoft? Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?

This title is pure sensationalism. The written piece says clearly "security vulnerabilities in the GStreamer multimedia framework. A combination of the Chrome browser and GNOME-based desktops creates a particularly scary vulnerability.". Somehow this very specific combination inflated to become Desktop Linux. My default installation came with VLC, firefox and KDE. No gstreamer nor gnome installed, google products inc…

Because some very big players are trying to conflate desktop Linux with Gnome+systemd...

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#137

About the $10K: don't forget that the french Gendarmerie runs on Ubuntu. See https://en.wikipedia.org/wiki/GendBuntu

Sorry but the french Gendarmerie does not run on Ubuntu. They use a custom made distro called GendBuntu which is based on Ubuntu as Ubuntu is based on Debian.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#139
post #76

Earlier quoted context omitted.

The 3rd party software is huge problem, actually. When you do apt-get or install using Ubuntu App Store it gives a false sense of security to novice user that things are safe. This is even more problematic because there are so many things one needs to download on default desktop to be on par with default Windows. The File Manager UI, for example, lacks too many features and user must investigate alternatives and eith…

> it gives a false sense of security Why is getting the latest security updates giving a false sense of security exactly? > The File Manager UI, for example, lacks too many features and user must investigate alternatives and either assume that everything is all right or deeply examine security vulnerabilities for each available option. Same goes for basic things like text editor or calculator and so on. This is where…

> Why is getting the latest security updates giving a false sense of security exactly?

Because in quite a few distributions you don't get security updates reliably. For example Debian Stable excludes most WebKit-based libraries from their update policy.

https://www.debian.org/releases/stable/amd64/release-notes/c...

So users of browsers like Midori and Epiphany or E-Mail-Clients like Evolution on Debian Stable, currently end up using a WebKit library that hasn't been updated in more than a year.

The same issue applies to Ubuntu and most of its derivatives as well. E.g. Ubuntu 14.04 users get a WebKitGTK+ library which hasn't been updated in almost a year.

http://changelogs.ubuntu.com/changelogs/pool/main/w/webkitgt...

Of course, the user doesn't get a warning dialog when he installs applications which rely on those outdated and insecure libraries.

Ubuntu users also shouldn't rely on packages from the Universe repository (which are by far the most packages), if they care about security. Those packages are community maintained and often don't get a single update in years. In the past they didn't even update Chromium reliably.

Re: Is the Linux Desktop less secure than Windows 10? [pdf]

#140
post #124

Earlier quoted context omitted.

'locate' is 35 years old. And has been available on linux desktops since 1991. Just saying.

I doubt very much my Slackware 2.0 copy had locate.

I've used locate ever since I used Linux, my first distro was Slackware downloaded to oh so many stiffies (the hard plastic successor to floppies) circa 1994, I certainly won't die in a ditch insisting it was in there but I would be very surprised if it wasn't.

I'll put in somewhere in the middle of my "mildly interesting to maybe know" research list.

Post reply on HN