[dead]
Ask HN: How do you trust that your personal machine is not compromised?
421–430 of 469 posts
Re: Ask HN: How do you trust that your personal machine is not compromised?
#422ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
Considering the security UI layers control device access, I don't think AOSP or Android in general (with its many vendor customisations) is the most trustable. Knowing a PUK-code for a SIM card you own (and you can insert/hotswap) is all you need(ed) to unlock practically any Android phone until recently. Granted, this got reported and then fixed, it doesn't matter how good the TCB is if the front door is wide open.…
Valid points.
> Architecturally, it seems to me that Apple with their own SoCs, bootrom, RTKit, iBoot etc. has a stronger platform trust case because they actually own the stack all the way with nobody else having a say about it.
That's why I specifically and only mention Pixel in my comment. Google's been doing their own hardware since Pixel 6. (iirc) Daniel Micay, creator of GrapheneOS, once said that Google shares firmware / proprietary code for the Pixel hardware "if you ask nicely enough".
Like you point out, eventually, one is left trusting a BigCo or worse assuming a flawed implementation is secure. Though, it isn't for the want of not trying. Or, to put it another way, "the best among the rest".
Re: Ask HN: How do you trust that your personal machine is not compromised?
#423Earlier quoted context omitted.
Windows does all of those, in addition to fine grained access controls. I would go so far as to say that the Chromium sandbox implementation is better than on Android because of the ability to completely de-privilege processes.
Windows struggles with feature adoption though. Win11 helped with the TPM requirement and features on by default, but MSIX apps are still underrepresented so userspace sandboxing is weaker. Windows virtualization-based security is great though, imo it's a significant advantage over Android
MSIX doesn't implement sandboxing. Apps can opt in to being sandboxed via that tech, but you can also write totally unsandboxed apps. There's also a very light weight app container mode called (internally) Helium which just redirects some filesystem and registry stuff, but the goal is to make uninstalls clean, not security.
The Windows kernel does offer an impressive number of options to lock down processes. Look at the Chrome sandbox code some time. The Windows API is huge but you can really lock it down a lot. The macOS sandbox architecture is, however, the best. The Linux approach is sadly in third place.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#424ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
Does LineageOS have a place alongside GrapheneOS and CalyxOS? Asking because I base hardware purchases on whether LineageOS is available for the device and wondering whether I should restrict further to GrapheneOS or CalyxOS.
There's overlap between CalyxOS and LineageOS. CalyxOS (privacy-focused ROM, currently Fairphone and Pixel-only) has different goals to LineageOS (Android ROMs for as many phones as possible); while GrapheneOS is a security-focused distribution. DivestOS is another credible alternative.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#425ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
You’re saying Android is more secure than iOS?
There's been academic comparison between the two OSes in terms of data security that you might be interested in: https://archive.is/tYzcX / https://www.arxiv-vanity.com/papers/2105.12613/ (caveat: Security posture on Android has changed quite a bit since that paper came out).
Re: Ask HN: How do you trust that your personal machine is not compromised?
#426Surprised not to see a mention of Talos II system based on IBM POWER9 technology that is open spec and otherwise a very competent build with fully open hardware FPGA mainboard and stuff like physical trip jumper protection, and potential for customised security measures via the BMC, Arctic Tern, et cetera. IBM is notoriously good at virtualisation, and POWER9 is very competent for machine learning workloads, the 2U a…
This is like the third time I'm hearing about these raptors in the past month and I want one. I want the $10,000 one. Your comment is the most constructive one in this thread, because it sounds like the solution for all the concerns expressed above has finally arrived. Who here is willing to put their money where their values are?
In reality none of the "privacy freaks" will ever purchase one, I've recommended these to various privacy-minded people I know and the majority either (1) can't see past the fact that it's IBM hardware (not hip), or (2) make up excuses the like of "DO YOU REALLY believe IBM would do a system without a backdoor? A system with a starting price of $5,500— it must be a rip-off, not good enough a deal for me!" I know there's plenty of nice and horrible people in everything but honestly if I got two bob a piece for every FOSS cheapskate I've encountered is too similar to one another for me _not_ to attribute this to cheapskate mindset. People who are saying things like "Mac is a rip-off!!! bad deal, Intel better performance" all the while being clueless on power consumption, for example. It's much cheaper to just say something seemingly profound like "There is no true privacy, we're all pwned by NSA!!" than to purchase and actively integrate an expensive RISC ISA system based on free hardware into your workflow... A the end of the day, we only have ourselves to blame.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#427Earlier quoted context omitted.
Linux is a security shit show but it is at least publicly auditable, which is a prerequisite to form reasonably confidence in the security of software, or to rapidly correct mistakes found. OpenBSD by contrast has dual auditing and a stellar security reputation, but development is much slower and compatibility is very low. seL4 as an extreme is a micro-kernel with mathematically provable security by design, but no wo…
I find it hard to believe that the Linux codebase being auditable makes Linux more secure by default than MacOS, iOS, and Windows. I doubt it is humanly feasible to fully read and grok the several million LOC running within Linux. I would, however, trust a default MacOS/iOS/Windows system over a default Linux system. The Linux community has a track record of being hostile to the security community - for their own goo…
I regret my poor description of seL4. It has proofs for how it functions, and how code execution is isolated, etc. That is not -every- security issue by any means but reviewing a spec is easier than reviewing code, and a small code footprint that forces things out of the kernel that do not need to be there is a major win. I hope more projects follow their lead.
As for Linux, piles of companies pay for Linux kernel security, though many bugs are found by academics and unpaid independent security researchers. Linux is one of the best examples of many-eyes security. None of those brilliant and motivated researchers are allowed to look at the inner workings of MacOS or Windows though Darwin is at least partly open source so I put it way ahead of Windows here.
Also re-implementations of most features from grsecurity have been in the mainline kernel for years. https://gist.github.com/madaidan/2031b844d760683af19e85bda18...
On system-call firewalling tactics like SELinux it is true very few use these in practice as most devs have no idea what a system call is, let alone how to restrict it. That said Kernel namespacing features have come into very wide mainstream use thanks to Docker and similar containerization frameworks which cover much of the scope of things like SELinux while being much easier to use.
As for most Linux /distributions/, I sadly must agree they favor compatibility and ease of use over security basically always. I will grant that Windows/MacOS enable basic sandboxing features that, while proprietary, are likely superior to nothing at all like most Linux distros. Other choices exist though.
QubesOS is the Linux distro for those that want high security. It is what I run on all my workstations and I would trust it out of the box over anything else that exists today as hardware access and application workflows are isolated by virtual machines and the base OS is offline.
Re: Ask HN: How do you trust that your personal machine is not compromised?
#428Earlier quoted context omitted.
Windows struggles with feature adoption though. Win11 helped with the TPM requirement and features on by default, but MSIX apps are still underrepresented so userspace sandboxing is weaker. Windows virtualization-based security is great though, imo it's a significant advantage over Android
MSIX doesn't implement sandboxing. Apps can opt in to being sandboxed via that tech, but you can also write totally unsandboxed apps. There's also a very light weight app container mode called (internally) Helium which just redirects some filesystem and registry stuff, but the goal is to make uninstalls clean, not security. The Windows kernel does offer an impressive number of options to lock down processes. Look at…
Is Helium mandatory for MSIX-packaged apps?
Re: Ask HN: How do you trust that your personal machine is not compromised?
#429ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
[dead]
Re: Ask HN: How do you trust that your personal machine is not compromised?
#430ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
[deleted]