Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When will we get secure desktop OSes? (2018)

games.greggman.com

Post reply on HN
Print view View original

21–30 of 102 posts

Re: When will we get secure desktop OSes? (2018)

#21

Post by code_duck »

userbinator wrote: post #13

This reads like fearmongering paranoia-propaganda for driving people towards the authoritarian centralised walled gardens... The problem is once you give an app perission then you never know when it's turning on the mic or the camera. The microphone and camera are unplugged when not in use. "secure"? No thanks, I'd rather sacrifice some security and keep my freedom. We're already losing the war against general-purpos…

Like many here, I’m sure, I would love to be able to physically disable my camera and microphone somehow but do not have that option.

Re: When will we get secure desktop OSes? (2018)

#22

Post by michaelt »

If you want to get there, I wouldn't start from here.

The problem is, from the status quo we have today it's hard to see how we'd get to a point of security without sacrificing general purpose computing.

After all, it's either possible for the user to promote an application to equal the power of the OS, or it isn't.

Oh, sure, you could make it mandatory to ask permission before getting that power. But many security people think we need a system that's secure even in the face of a gullible user who will click through any warning. And there are thousands of applications that enjoy unlimited permissions today; for them, asking for maximum permissions will be the path of least resistance.

The alternative is the iPhone approach: Every app in a sandbox, and no way out of the sandbox even with the user's consent.

Re: When will we get secure desktop OSes? (2018)

#23

Post by [deleted] »

klodolph wrote: post #8
jcelerier wrote: post #3

Earlier quoted context omitted.

Making it an OS more hated by the day.

I mean, that’s actually a fair observation, at least on HN. A lot of people on HN do complain about the changes. There’s a tradeoff between security and convenience. Making something more secure is, essentially, making it harder to use for undesired use cases. The side effect is inevitably that it also makes it harder to use for legitimate use cases.

[deleted]

Re: When will we get secure desktop OSes? (2018)

#24

Post by helsinkiandrew »

I think the reality is that the average HN reader/developer and the general public want/need a device with requirements that are very far from each other and are very hard to integrate.

A chrome book like device that gets wiped every time it's started and downloads a clean OS so the user can browse the web, play games, and edit (remotely housed) documents would suit 90%+ of the world.

Perhaps developers should be using different OS from users.

Re: When will we get secure desktop OSes? (2018)

#25

Post by chrisseaton »

userbinator wrote: post #13

This reads like fearmongering paranoia-propaganda for driving people towards the authoritarian centralised walled gardens... The problem is once you give an app perission then you never know when it's turning on the mic or the camera. The microphone and camera are unplugged when not in use. "secure"? No thanks, I'd rather sacrifice some security and keep my freedom. We're already losing the war against general-purpos…

> The microphone and camera are unplugged when not in use.

Seems really inconvenient to have to physical unplug things when you're not using them. And in laptops and other integrated devices you can't unplug them.

Re: When will we get secure desktop OSes? (2018)

#27

Post by elric »

lalaland1125 wrote: post #26

The secure desktop "OS" exists. It's called a browser. We have reached the point where most people can get by purely using browser based software that is secure because browsers use good sandboxes.

Calling a browser "secure" is quite the stretch...

Re: When will we get secure desktop OSes? (2018)

#28

Post by michaelt »

edu-ap wrote: post #16
userbinator wrote: post #13

This reads like fearmongering paranoia-propaganda for driving people towards the authoritarian centralised walled gardens... The problem is once you give an app perission then you never know when it's turning on the mic or the camera. The microphone and camera are unplugged when not in use. "secure"? No thanks, I'd rather sacrifice some security and keep my freedom. We're already losing the war against general-purpos…

What about snaps on Ubuntu? https://www.howtogeek.com/670084/what-you-need-to-know-about...

But everyone hates snaps.

Huge files (made worse by an insistence on keeping two versions of everything around). Slow to start even a simple calculator. Fills the mount list with spam. All to deliver the "feature" that Discord can't share a file from ~/.minecraft/screenshots/whatever.png and ffmpeg can't access /dev/video0

Users prefer dpkg so clearly that Canonical had to make a fake dpkg file for Chromium that installs it using snap.

Re: When will we get secure desktop OSes? (2018)

#29

Post by elric »

gentleman11 wrote: post #15

I don't understand the responses in this thread. Does nobody want an OS with a permissions system where you can reliably control access to resources? Or strong app sandboxing by default to keep chrome from sniffing your files (allegedly, this is virus scanning)? There isn't any loss of freedom with those as long as your super user can modify it all - its a gain of freedom in that you can have some control over what y…

Agreed. Tools like Firejail and OpenSnitch go a long way towards this, but it could be better. There's also the matter of presenting this in a way that is useful to the average user .. by the time a user sees a third popup asking "Do you want to allow Firefox to access 23.12.99.8?" they will have been conditioned to always click [OK].

Re: When will we get secure desktop OSes? (2018)

#30

Post by _rdvw »

Sandboxing is a huge issue that plagues desktop operating systems. And sadly is it only one piece of the puzzle. Android for example additionally has detailed SELinux policies and extensive compile time hardening.

You can sandbox the majority of your apps on desktop Linux today with two simple commands:

- sudo apt/dnf install firejail

- sudo firecfg

Project: https://github.com/netblue30/firejail

Intro Video: https://www.youtube.com/watch?v=N-Mso2bSr3o

Disclosure, I am a contributor to firejail.

Also if you are already using flatpaks, you can install flatseal to easily point and click which permissions you want:

https://www.flathub.org/apps/details/com.github.tchx84.Flats...

Lastly you can sandbox your systemd daemons:

https://www.freedesktop.org/software/systemd/man/systemd.exe...

Have fun!

Post reply on HN