Is the Linux Desktop less secure than Windows 10? [pdf]

Post by digi_owl » Mon, Feb 06, 2017, 10:42 AM UTC

xorcist wrote: post #42

When this metadata indexing was introduced in gnome/kde many users complained, because it pegged their cpu and was really unasked for. But some felt that this was something the MacOSX had and therefore some developers felt it was a good default. I'm not convinced, partly because of the increased attack surface. The desktop environment itself is but a small part of the complete desktop. Some important differences betw…

Post by nottorp » Mon, Feb 06, 2017, 10:46 AM UTC

21 wrote: post #48

nottorp wrote: post #35

Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"? Is it easier to change your media player on Linux, or to trust Microsoft? Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?

To answer the second question, no. A fresh install of Windows connected to the Internet will not be infected automatically (of course, assuming no new 0-day)

Post by digi_owl » Mon, Feb 06, 2017, 10:47 AM UTC

nottorp wrote: post #35

Hmm. If i look at the slides, the article should be renamed "gstreamer, and some stuff browsers on all platforms do, are insecure"? Is it easier to change your media player on Linux, or to trust Microsoft? Say, does a default Windows install still enable 20 networked services that don't belong on a home computer and can be exploited without the user downloading anything?

Post by digi_owl » Mon, Feb 06, 2017, 10:49 AM UTC

nimish wrote: post #31

Given that piping curl in bash with sudo is considered acceptable, this is not surprising

Post by digi_owl » Mon, Feb 06, 2017, 10:50 AM UTC

bkor wrote: post #66

blorgle wrote: post #25

I am a big fan of grsec, RBAC and sandboxing stuff. But let's be real here people! Those are good features on servers where there isn't a giant security black-hole called X, where any local exploit of the app can turn it into a compromise of the entire GUI system. Look at the hoops that adversary resistance focused distros like SubgraphOS have to jump through just to mitigate the giant attack surface that X opens. Un…

Security should be multi layered. So if one thing fails there's still yet another layer of defence. This because everything will have bugs anyway, so it should be assumed none of the layers will ever be fully secure. systemd offers various methods to restrict daemons in their abilities. That's hardly used. Only recently tracker started sandboxing their indexers. Why block adding other security laters on Wayland? Ther…