It seems to me that a secure OS would be an OS I wouldn't care to use. It would be so locked down that I couldn't really tinker with it.
Have a look at Qubes OS. It's a joy to use for me.
When will we get secure desktop OSes? (2018)
51–60 of 102 posts
Re: When will we get secure desktop OSes? (2018)
#52Qubes OS is perfectly usable if you are a technical person and describes itself as "reasonably secure" https://www.qubes-os.org/ . They take the security challenges of all the layers of the onion pretty seriously and have built a system that works well for many threat models. You do have to put up with some inconvenience (eg copying and pasting between vms etc) but you get a lot for that.
Agreed. The main catch for most people who should be using it may be to first get hardware with full support to install it on. The range of machines with TPM and the appropriate virtualization and memory control capabilities is long enough, at least for laptops, but to additionally neuter Intel ME (AMD PSP still unsolvable for now?) and install open firmware and still have all of the functionality needed, is a pretty high bar.
Then again, even without that last distance, at least it would improve the situation in many cases.
I think Greggman is mostly wrong the software which people want to run is not available to run on Qubes, but one probably has to admit that stuff not available in the repositories of the Template systems could be a bit arduous to configure. Fancy Windows games demanding a powerful GPU seems a bit like asking for trouble that way. Probably both doable and acceptably practical with enough motivation though.
Re: When will we get secure desktop OSes? (2018)
#53This article is from 2018. Many of the points made in this post have since been addressed by macOS, and continue to be addressed. In fact, some of the issues the author complains about were addressed by the macOS in 2018.
does macOS have any way of detecting/showing/preventing screenshots/screenrecordings? I'm not sure if newer macOS versions have that kind of fine-grained control over privacy.
Re: When will we get secure desktop OSes? (2018)
#54Qubes OS is perfectly usable if you are a technical person and describes itself as "reasonably secure" https://www.qubes-os.org/ . They take the security challenges of all the layers of the onion pretty seriously and have built a system that works well for many threat models. You do have to put up with some inconvenience (eg copying and pasting between vms etc) but you get a lot for that.
Agreed. The main catch for most people who should be using it may be to first get hardware with full support to install it on. The range of machines with TPM and the appropriate virtualization and memory control capabilities is long enough, at least for laptops, but to additionally neuter Intel ME (AMD PSP still unsolvable for now?) and install open firmware and still have all of the functionality needed, is a pretty…
Yeah. In my experience it has worked great on things like Lenovo Thinkpads and I also have it running on a Pureism Librem 15. It's sometimes a bit inconvenient but is totally usable as a daily main work OS (I used to use it as such).
Re: When will we get secure desktop OSes? (2018)
#55This article is from 2018. Many of the points made in this post have since been addressed by macOS, and continue to be addressed. In fact, some of the issues the author complains about were addressed by the macOS in 2018.
does macOS have any way of detecting/showing/preventing screenshots/screenrecordings? I'm not sure if newer macOS versions have that kind of fine-grained control over privacy.
Yes, there is the "Screen recording" parameter in Security & Privacy settings.
Also, I remember getting some issues with apps like "Bartender 3" that requires taking screenshots regularly to rearrange the top bar (!!) [1]. Never accepted that and moved to another app...
[1] About the "Screen Recording" permission for "Bartender 3": https://www.macbartender.com/Screen-Recording-Permission/
Re: When will we get secure desktop OSes? (2018)
#56Earlier quoted context omitted.
I mean, that’s actually a fair observation, at least on HN. A lot of people on HN do complain about the changes. There’s a tradeoff between security and convenience. Making something more secure is, essentially, making it harder to use for undesired use cases. The side effect is inevitably that it also makes it harder to use for legitimate use cases.
I have a suspicion that the most vocal complainers don't even use it.
I am sadly typing this on a mac right now and it's a constant pain versus my main linux system (which is in a lot of aspects also a big pain when I think about how simply everything worked in win98). Have to right-click > open every other app I use, gatekeeper blocking apps for no good reason, etc etc
Re: When will we get secure desktop OSes? (2018)
#57That is a problem. You shouldn't trust apps. You should haven't to trust apps any more than you should have to trust webpages. Apps can be just as evil as a webpage. In fact apps can be more evil because at the moment they aren't sandboxed on Mac or Windows or Linux so they can do far more damage than a webpage.
Please no. Leave it to the phones, I don’t want to answer stupid “would you like this app to …” questions to see an image gallery, open a text file or click on an url shortcut. I have trust in my apps, in the same way I trust my guests to not dig in my closets, and it’s not really a huge deal if they do. I don’t want to turn my house into a set of prison cells and guarded corridors, even if I’d have all the keys. If I don’t like you or heard something compromising, you’re simply not welcome, enforced by the only lock on my door.
Re: When will we get secure desktop OSes? (2018)
#58I find it hilarious the article is written by a Chrome developer. Chrome is not a Windows store app. It could have been (MS edge was for years) but it's not. Store apps are substantially more secure than Win32 apps, at the cost of smaller API surface and less permissions.
The article is about sand boxing APIs in the OS. He does mention that app stores are not a solution and gives sound reasons.
Re: When will we get secure desktop OSes? (2018)
#59Earlier quoted context omitted.
But everyone hates snaps. Huge files (made worse by an insistence on keeping two versions of everything around). Slow to start even a simple calculator. Fills the mount list with spam. All to deliver the "feature" that Discord can't share a file from ~/.minecraft/screenshots/whatever.png and ffmpeg can't access /dev/video0 Users prefer dpkg so clearly that Canonical had to make a fake dpkg file for Chromium that inst…
From a user perspective : it does work. I always had issues running Spotify on it if I ran a newer Ubuntu than Spotify built their application for. Now I run the snap and everything just works.
That might just be because you're now running the latest version?
Were you previously running the distro supplied Spotify or from Spotify's own APT repo?
Re: When will we get secure desktop OSes? (2018)
#60That is a problem. You shouldn't trust apps. You should haven't to trust apps any more than you should have to trust webpages. Apps can be just as evil as a webpage. In fact apps can be more evil because at the moment they aren't sandboxed on Mac or Windows or Linux so they can do far more damage than a webpage. Please no. Leave it to the phones, I don’t want to answer stupid “would you like this app to …” questions…
You can sandbox apps without stupid UI. Have a look at Qubes OS.