31–37 of 37 posts
Earlier quoted context omitted.
> So I'll have to create another user account to run a web browser, my mail client, a software package manager or a compiler? If you can't trust those you have bigger problems than them reading your home directories. If you're paranoid use flatpak.
They're all written by idiots in C. Why would I trust them?
Earlier quoted context omitted.
> it's a lot better than anything Unix side due to the ACL and security model. Better is subjective. It's maybe more capable. It's also easier to create confusing DACL structures that do not do what you think they do or leave surprising gaps in coverage. > and grew to a huge size and surface area and that is hard to fix retrospectively. We added network cards to everything at the same time networks finished moving fr…
> Better is subjective. It's maybe more capable. It's also easier to create confusing DACL structures that do not do what you think they do or leave surprising gaps in coverage. There is nothing confusing about it at all. The problem tends to be poor understanding and poor default configuration in all these things. I mean the same can be said for the average linux user, who ambles on in and 777's everything. We added…
It comes up as an item in our internal corporate audits all the time. The fact that parent and child can have independent access is a surprising one in most mental models and a problem that just doesn't exist in the simpler unix model.
The ability to create permissions for things that don't even exist yet is another surprising thing that catches administrators up. It does not help that the windows GUI tooling is exceptionally inferior compared to the command line tooling.
This is on production servers in sensitive environments. That linux home users chmod 777 is one thing, but I don't see the same types of problems in professional linux environments; granted, you don't see as many comparable linux environments at all. Likewise, explorer makes it easy to just "give permissions to Everyone" and I've seen that just as much in home installations. In any case, these are probably not great comparisons.
Earlier quoted context omitted.
> It's not insecure by design really. Sure it is. Features like Recall, which the article mentions, are insecure by design. > the ACL and security model I'm not sure how this is any more secure than "Unix side". But in any case the security holes in Windows are not problems with its filesystem (at least not now that FAT is no longer used). > Anything which can read ~ is a problem Which in a properly configured Unix s…
> Sure it is. Features like Recall, which the article mentions, are insecure by design. I'm going to be honest: I'm not bothered about Recall security. It'd be on a single user machine which contains my data anyway. There are many more tasty morsels out there if a keylogger gets on it. Like the contents of my Keepass DB or my online banking PIN, neither of which Recall would be party to but anything that runs as my u…
Not if you trust those things. And if you don't trust them, you shouldn't be using them.
> or a compiler?
On my personal machine, yes, I have a separate user account for development, such as compiling programs. Creating new user accounts on a Unix machine is pretty simple.
Earlier quoted context omitted.
> Sure it is. Features like Recall, which the article mentions, are insecure by design. I'm going to be honest: I'm not bothered about Recall security. It'd be on a single user machine which contains my data anyway. There are many more tasty morsels out there if a keylogger gets on it. Like the contents of my Keepass DB or my online banking PIN, neither of which Recall would be party to but anything that runs as my u…
> So I'll have to create another user account to run a web browser, my mail client, a software package manager or a compiler? If you can't trust those you have bigger problems than them reading your home directories. If you're paranoid use flatpak.
I don't think this is a good solution, both because the so-called "sandboxing" isn't all it's cracked up to be, and because you now have to depend on each individual app vendor to push you security updates, instead of just your Linux distro.
The really paranoid would probably be using BSD with jails, which AFAICT is one area in which the BSDs are ahead of Linux.
Earlier quoted context omitted.
> So I'll have to create another user account to run a web browser, my mail client, a software package manager or a compiler? If you can't trust those you have bigger problems than them reading your home directories. If you're paranoid use flatpak.
They're all written by idiots in C. Why would I trust them?
Even as a well known "windows hater", this is hyperbole. It's not insecure by design really. In fact in principle it's a lot better than anything Unix side due to the ACL and security model. It did however exist before anyone gave a crap about security, was implemented in a vastly insecure language and runtime and grew to a huge size and surface area and that is hard to fix retrospectively. I'll give Linux a stab her…
this above, and the corporate behaviour, is why im a not windows guy
Earlier quoted context omitted.
What's clickbait about it? It's the title of the article as written by the author. How would one even go about automatically flagging "clickbait" titles? Obviously the term means different things to different people.
Arguably the entire article is clickbait, it's just rant running under the Opinions section.