71–80 of 100 posts
Earlier quoted context omitted.
Full disk encryption is more secure. If you can't trust your system files who knows whats happening when you enter your password.
Isn’t Secure Boot supposed to solve that issue?
You need either full disk encryption, or something like dm-verity for that.
Makes sense to me, but I'd be much more excited to go back to not having the snap directory shoved in my face.
I left Ubuntu because of snap - and I don't see myself going back. It's funny, I feel like eventually every distribution has to do something to irritate long-term users, but endear themselves to others. It's part of a weird growth phase.
https://bugs.launchpad.net/ubuntu/+source/adduser/+bug/48734
To me, user accounts have always seemed like the more reasonable approach to sandboxing vs. cloning the universe to run a single program in a container. Most of my systems have a user for myself, and one or two other users like `sketchy` or `test` or something for programs that I trust enough to run, but don't trust enough to not fuck up my home directory in some way (including modifying startup scripts, which IMHO s…
Earlier quoted context omitted.
I run such less trusted programs on other machines . The privilege elevation attack surface is just too big on a normal Linux system. That's why I think intra-user isolation is better. I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such).
Isn't SELinux supposed to provide exactly this functionality? The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess. I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu.…
Profiles are indeed tricky though, and generally something I would consider more easily implemented as just logging in as a different user.
I can't speak much about AppArmor since I'm not too familiar with it.
Earlier quoted context omitted.
Isn’t Secure Boot supposed to solve that issue?
How can Secure Boot help against, say, patched libc? You need either full disk encryption, or something like dm-verity for that.
Earlier quoted context omitted.
I run such less trusted programs on other machines . The privilege elevation attack surface is just too big on a normal Linux system. That's why I think intra-user isolation is better. I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such).
Isn't SELinux supposed to provide exactly this functionality? The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess. I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu.…
Earlier quoted context omitted.
I’ve been using fscrypt to encrypt my home directory for over a year now and it seems to work fine: https://wiki.archlinux.org/index.php/Fscrypt
Hi! Author of fs-crypt dropping in from the interwebs. I also created eCryptfs, which was Ubuntu's original home directory encryption technology, with lots of additional distro integration work by Dustin Kirkland. Unfortunately I had to make some compromises when going with the stackable model, and that caused some problems. I took the lessons I learned from that first attempt and created fs-crypt as a sort of atonem…
Even Ubuntu's calling Linux home desktop 'quaint' now..