FOSS insecurity

Everyone knows security researchers like Madaidan and Daniel Micay claim that open source software like Linux and Firefox isn't secure and that proprietary software from Google, Microsoft, and Apple is far more secure. To them, other researchers, and even privacy advocates, the source model doesn't matter anymore. It is true that a lot of open source software (and hardware) is less secure than their proprietary counterparts including: >Linux and OpenBSD vs Windows, MacOS, and ChromeOS >Mozilla Firefox, Ungoogled Chromium, and Pale Moon vs Google Chrome and Microsoft Edge >Linux phones vs Google Pixel phones and iPhones >Veracrypt vs Bitlocker >LibreOffice vs Microsoft Office >QEMU vs Hyper-V The problem is that a lot of security researchers who claim to support privacy recommend proprietary software and demonize open source. Whether or not the software or hardware respects your freedoms or includes telemetry isn't taken into consideration ("oh you can just disable telemetry in the settings and you shouldn't use antispying tools or arkenfox user.js you should just use official documentation"). Not only do they give awful recommendations, but they don't seem to support these free and open source projects, instead thinking these developers should just give up, deprecate their software, and push their users to use proprietary software instead. I don't think these insecure projects are bad. I think developers should fix these security issues and narrow the gap between FOSS security and proprietary security. Projects like Linux and Firefox should keep catching up to ChromeOS and Google Chrome, and other browsers like Ungoogled Chromium or Pale Moon should fix their security issues. The problem is, a lot of these projects lack the resources necessary to catch up (Firefox), are so far behind that there's no catching up (Linux), or a combination of both (OpenBSD). Other projects like LibreOffice and VeraCrypt will never be as secure as Microsoft Office and Bitlocker because they aren't integrated into Windows (Linux users aren't affected by this and can use these though I'd use LUKS over VeraCrypt). Microsoft Office can utilize Microsoft Defender Application Guard (MDAG) and LibreOffice cannot and never will. Of course, most people do not need software to be open source because they aren't programmers who know how to read or modify the source, and most open source software hasn't been audited. Whether or not software is open source or proprietary doesn't affect them. However, other things such as repairability and planned obsolescence (for laptops) or online account requirements (for browsers and operating systems) do affect most consumers since it determines how long they can use their devices and what they can use them for. Most of us shouldn't be paranoid about telemetry since we're not at high risk and privacy is already non-existent as everything to know about us is already online in countless databases and surveillance and tracking has became too complex. Not to mention that today's children are doomed from the start as since they day they were born their parents posted pictures of them on every social media platform, everything to know about them will be made public before they get a chance to do anything about it, and all of their activites will be monitored by governments, corporations, and schools without their knowledge. We are not losing our privacy. We have lost our privacy. There's nothing futuristic about this. We just have to accept that it is impossible to have privacy and there's nothing we can do about it. I don't want to live in a world of proprietary software and mass surveillance, but that's exactly what world we live in and I just have to accept that. I hope free and open source software catches up and privacy makes a comeback, but I doubt it ever will. If anything, free and open source projects like Firefox and Linux will only fall farther behind in security or will end development.(USER WAS WARNED FOR THIS POST, This is a terrible opening, saying everyone knows, when everyone doesn't know, and then not elaborating on your opinion or providing sources, is a Rule 3 and Rule 4 violation. Always argue in good faith and avoid using personal attacks. You should always elaborate on your opinions rather than just spilling the soykaf. )

Windows has known backdoors, so why the fuarrrk would you want to talk soykaf about linux being less secure. Also security is not a feature for the user until it causes an issue. What it does is limit features and cause costs that always affect the user as insecure is always faster with more freedom of use. Closing a system for security is a downside unless it matters.

Wow another dumb astroturrf post funded by Bill Gates telling you to give up >Most of us shouldn't be paranoid about telemetry since we're not at high risk and privacy is already non-existent as everything to know about us is already online in countless databases and surveillance Dumb black and white binary thinking >Of course, most people do not need software to be open source because they aren't programmers who know how to read or modify the source, and most open source software hasn't been audited. That argument makes no sense since proprietary software definitely hasnt been audited either. in the end of the day, for 99% of use cases, proprietary software are bloatware for telemetry datamining or platform lock in. Just because SOME open source may have hidden in their code some telemetry, doesnt mean you have to give up and install safari and buy into the Apple or Windows botnet. For simple things such as a text editor, why would anyone need a proprietary software that a lot of the time requires you to sign in with a user ID and connect to the internet, which definitely is surveillance where you are the product. When you can install open source equivalent that probably does not have, but may in some small outlier cases, have hidden telemetry.

>>62687 >GET OFF OPEN SOURCE APPS WHICH MIGHT BE ATTACKED IF THE STARTS ALIGN! >INSTEAD USE SOFTWARE WHICH ALREADY SENDS YOUR DATA THROUGH THE NET AND TRUST NOTHING LEAKS I hate talking in halfchan lingo, but that security argument seems kinda not worth paying attention to

>>62687 I could believe it when someone says that Chromium is more secure than Firefox. But saying that Goolag Chrome (spyware) is more secure than Chromium doesn't make any sense, since Chromium is just Goolag Chrome without the spyware components (and Chromium is also FOSS). Hiding the source (proprietary software) doesn't increase the security (security through obscurity is not real security). >Everyone knows security researchers like Madaidan and Daniel Micay You could have provided links to their articles. I could only find Madaidan's article: https://madaidans-insecurities.github.io/linux.html (and his hardening guide: https://madaidans-insecurities.github.io/guides/linux-hardening.html) >are so far behind that there's no catching up (Linux) BS. With Botnet 10, M$ added some exploit mitigation features that aren't present in Linux (as far as I know). And do you think that Windows doesn't have any legacy code? Companies and developers could add more exploit mitigation features to Linux kernel and the toolchain, too (why couldn't?). >Bitlocker Likely backdoored. Use TrueCrypt or VeraCrypt. >Microsoft Office can utilize Microsoft Defender Application Guard (MDAG) and LibreOffice cannot and never will. You can literally just use VirtualBox or Qemu. >Of course, most people do not need software to be open source because they aren't programmers who know how to read or modify the source False. First, there is not planned obsolescence in FOSS projects. Free Software also means that you can share the software, and there aren't arbitrary limits on how you use FOSS software. With FOSS, you can also ask someone else to write a patch (and that person is able to do it, if he can program). Moreover, proprietary software is often malware and mistreats the users (for example by collecting telemetry and analytics that are used to target ads and track users). For example, Digital Restrictions Management systems can limit how you use the software/game you have spend money on and own, or set a limit on how many devices you can install the software/game. For more cases of proprietary software being malware: https://www.gnu.org/proprietary/ >and most open source software hasn't been audited. Most proprietary software hasn't been audited, either. Moreover, for-profit companies may have a motivation to fix security issues in the next release (cheaper to QA test if you wait for the next update or easier to get customers to buy the next version). >Most of us shouldn't be paranoid about telemetry Why don't you also stop posting, if your rights aren't important to you, then? Saying "i don't have anything to hide" is as dumb as saying "i don't have anything to say". >Not to mention that today's children are doomed from the start as since they day they were born their parents posted pictures of them on every social media platform, >neurosuggesting that you have to have 100% privacy or have 0% privacy and not care at all You should minimize the amount of data the system and corporations collect.

>>62691 >Moreover, for-profit companies may have a motivation to fix security issues in the next release (cheaper to QA test if you wait for the next update or easier to get customers to buy the next version). By this I meant that for-profit companies have a motivation to postpone releasing a patch (and release it with the next planned update, instead of ASAP).

>LibreOffice vs Microsoft Office LibreOffice is a million times more secure than Microsoft Office by virtue of using a genuinely open file format by default, please kill yourself if you ever send someone a .docx in an email attachment.

Already 6 replies. When will you stop responding to this guy?

>>62687 >openbsd >less secure I can see where you're coming from about Linux but wtf are you smoking dude? Madaidan even deleted his hitpiece on OpenBSD. I would say he is justified in keeping his Linux one up, though. >Linux phones Nobody seriously recommends Pinephones ever since they started giving Manjaro (aka SHIT OS) supremacy over their platform. >most of us shouldn't be paranoid about telemetry Bullshit. You might know people who are. Let me tell you, they're more common than you think and don't look at all like what you'd expect. Bottom line: People say privacy and security are different. While that's true, it's also true that they're inseparable and you can't have a reasonable expectation of one without the other.

>>62701 >Madaidan even deleted his hitpiece on OpenBSD. 26 days ago, Madaidan posted the following on reddit: >OpenBSD is widely considered by real security experts to be a meme. >https://isopenbsdsecu.re/quotes/ https://old.reddit.com/r/PrivacyGuides/comments/v1luh1/looking_for_more_context_and_viewpoints_on/ihu78k5/ Of course, Madaidan is a hypocrite as he uses Linux and Firefox against his own advice. Not only that, but he uses Arch Linux which uses systemd, and he advises not to use systemd.

>>62707 >Madaidan is a hypocrite as he uses Linux and Firefox against his own advice Why do people say that? There is nothing hypocritical about being a security researcher and deciding to use something that isn't the 'most secure' option. There is nothing hypocritical about using something you know has issues. Last time I checked, his advice isn't 'don't use it', it's 'stop calling it the most secure'.

>>62735 Then why in his security and privacy advice does he say "Do not use Linux" and not "Do not call Linux the most secure"?

In theory FOSS is superior. The reality of it is what people did. People did what for what reason? Money comes up, companies want to make money, and they make money.

>>62740 Theory and hypotheticals. It sounds great on paper. Kinda like communism.

>>62742 Idealism is not realism. Yet the ideals are the goals to uphold. Our conditions are still in part what we organize. Same goes for communism. If we ever reach utopia, it would correctly be described as communism.

I appreciate all the replies. I support free software and believe in freedom, but I don't believe it's as secure as proprietary software which is why I stay away from it until it's secure (which it'll likely never be). About LibreOffice, it might be okay for Linux (not secure) users but on Windows it can't utilize MDAG unlike OpenOffice, so it isn't properly sandboxed. TrueCrypt/VeraCrypt shouldn't be used because it breaks the chain of trust between the UEFI and Windows Bootloader. Bitlocker is only backdoored on Home edition since the keys are stored on Microsoft servers. https://github.com/beerisgood/Windows11_Hardening/blob/master/Why%20not%20use%20TrueCrypt-Veracrypt I recommend reading Beerisgood's Github repos. https://github.com/beerisgood It's true proprietary software hasn't been audited either, but it's at less risk since the source isn't available for hackers to modify or release fake binaries. Never install software from third-party vendors. Use the official package management/app store or the official binaries from which can be downloaded legitimately. So without taking anything else into consideration, from a security standpoint (and security and privacy are not the same), what is the most secure operating system? What about the most secure web browser?

>>62751 >what is the most secure operating system? TempleOS - no networking and meltdown got fixed ahead of time (ring 0 only!). Just burn TOS to a ROM chip.

>>62751 bait thread > what is the most secure operating system? The one you build yourself and can understand its weakneses. > breaks the chain of trust between the UEFI and Windows Bootloader It's debatable how trustworthy a chain of trust based on untrustworthy closed source blobs really is. > release fake binaries User falling for phishing is not a security property of the program. Besides, patching exists. If anything, proprietary software would be more susceptible to this. Downloading executables not approved by the vendor and running them as they are is common. How can you tell that it comes from a good source, hasn't been tampered with, and will work exactly the way you expect?

>>62751 >https://github.com/beerisgood/macOS_Hardening >Electron based programs should be avoided Electron is Chromium based >install Google Chrome >Install software only from the App Store Nobody should use anything from the App Store, just use homebrew.

>>62739 >>62735 >>62707 my personal uninformed guess about the major disconnect between security researchers and the broader population of technical people is that security researchers seem to mainly be discussing people whose threat model is actually somewhat serious, in the context of "a criminal is going to attempt to specifically compromise my machine". for instance, if you're a hospital with patient medical records or a lawyer with important clients who want things kept secret, you shouldn't be using linux on the desktop computers containing that information. but if your greatest concerns are corporations spying on you for data collection/advertising, along with like... not getting a virus or spyware on your computer, then there's not really any concern for which operating system you use. that's why micay and madaidan use linux (iirc both of them use arch) despite deriding its horrible security - they aren't really going to be targeted specifically, and it's pretty hard to get your computer compromised as long as you have basic computer literacy + aren't being targeted. i also suspect a lot of the security talk is more about future proofing than actual present threats. despite having horrible security in theory, it seems like current offensive security is just really far behind right now. (i remember reading a story where facebook had to pay a firm 2 million to come up with a compromised video file to catch a particularly evil pedo using Tails Linux.) i am not an expert at all in this, this is just what i've gleaned from the discussion.

>>62764 It's not a discussion. It's one guy who's been using the same bait for more than half a year, and people continually repsonding to it. What you've said about that disconnect has been said before.

>>62779 On lainchan it's one guy. There aren't dozens of people itching to inform people here that they shouldn't use linux or any browser that isn't google chrome.

>Micay claiming that proprietary software is more secure >as he uses an open source project to create the most secure OS on the planet, also open source What did he mean by this?

>>62782 it's more like "current proprietary software happens to be more secure" not "proprietary software is inherently more secure" pretty much all of micay and his kin are big on open source, hence why they annoyed torvalds into calling them masturbating monkeys

>more secure >less secure what the actual fuarrrk do these terms mean? it's like saying a hammer hits less hard...

>>62797 Not even, your analogy makes far more sense. It's like saying it's better. Better for who? Better at what? On what axis is better defined? Can a multi-faceted software be reduced to a mere linear 'better' or 'worse'? It's a nonsense term unless you qualify it with a proper context. >>62782 >the most secure OS on the planet Not only incorrect (Micay would agree) but nonsensical. Please understand why this phrase makes no sense before talking about security.

>>62764 > if you're a hospital with patient medical records or a lawyer with important clients who want things kept secret, you shouldn't be using linux on the desktop computers containing that information. you shouldn't be using a standard computer to store that kind of data. storing it in a bulletproof server would be good enough, although i think that the best way of keeping it would be offline

>>62828 >>slavery is far from ideal This should be obvious to anyone. >That's relative. It's relative, because we're far from ideal. But this take on it implies we're unethical as species, which again implies we're far from ideal, considering to do things far from ideal, as far from ideal species do. Achieving the ideal is impossible. Achieving the ideal using slavery is crazy stupidly impossible.

>>62687 >researchers like Madaidan and Daniel Micay claim that open source software like Linux and Firefox isn't secure and that proprietary software from Google, Microsoft, and Apple is far more secure. And who is paying them to say that? You can't just take someone's opinion at face value without understanding the incentive structure they live in. +1 for triggering a mod though >>62797 Threat modelling rule of thumb: if you don't explain exactly what you are securing against and how you secure against it, the answers can be assumed to be: "bears" and "not very well" >>62779 People who have never worked in tech assume all computers are desktops and Windows is the default and Lunix is that weird hobby thing nobody takes seriously.

If you think OpenBSD is less secure than Windows or even MacOS, you are crazy.

>>64106 Not so. Ignorance and contrarianism will do it easily

>>64106 >If you think OpenBSD is less secure than Windows or even MacOS, you are crazy. If Theo, or someone else who can sign and push updates, is out to get you the windows absolutely is more secure than openbsd. Security doesn't mean anything without a threat model.

>>62742 >>62744 Foss is not superior in theory, but in practice. See it like capitalism vs communism: neither one had existed ever, but you can see that nations tending more to socialism are poorer, have less freedom and end up failing as nations with more libertarian and individualistic rights are more free and are better in everything (aka Cuba vs Switzerland example) It's not like you should replace communism and capitalism with propietary and foss because it is not the same but what I wanted to say is that foss is proved to work better and freer versus propietary software. I think the problem is not propietary software as people have the right to profit off their work but the (((corporations))) are trying to control the world.

>>62687 Choosing known botnet because there might be issues with FOSS (where code is audited unlile closed source). Not to mention, these companies will for some reason or other have their data stolen which will be your data.

>>65449 this is a misinformed post

the amount of autistic retarded ramblings in here is reminiscent of the reaction r/privacy has to madaidans. I don't even want to waste my time responding to these terrible arguments.

the platforms are insecure by design, it's not paranoia and they're not doing much to hide it. but FOSS can be insecure through negligence, for example default Arch installs are not encrypted, and EFI bootloader security is a joke. the question is if you're mad noided and want to avoid dragnet surveillance like those time and date window warrants made to google maps or whether you want to avoid having your work phone/laptop cracked by a PI or other scumbag that wants your data. for the average person buying an iphone or m1 mac is way safer than whatever they could roll together from the extremely fragmented and inconsistent FOSS ecosystem, with the caveat that the apple soykaf phones home.

>>68126 >for the average person buying an iphone or m1 mac is way safer than whatever they could roll together from the extremely fragmented and inconsistent FOSS ecosystem +1 Company Scrip deposited in your Loyalty Account

What the fúck did I just read? Since fｕcking when is proprietranny shítware more secure that Open Source? Those "researchers" are 100% paid shílls, or probably just f,cking retards.

>>68130 https://www.bleepingcomputer.com/news/security/uefi-firmware-vulnerabilities-affect-at-least-25-computer-vendors/ yeah, the m1 architecture inherited the ios boot chain because efi is a mess and secureboot isn't. it's not perfect but if you keep your firmwares up to date you can trust you're booting what you think you are.

>>65745 you mean like that microsoft has not made a single security mistake for 20 years? while linux has a new security vulnerability every couple days leading to billion dollar losses for poor sucker corporations whose employees have bought into their pet fetishes and forced it until the entire corporation ran on it?

It's secure in the same way a maximum security prison is. For the average complete non-techie person who just uses a messenger, email app and a browser, an Apple device that gets security updates for 5 years or so is probably better than some Motorola phone that's gone unsupported for 3 years. I hate Apple personally but I can see where the argument for them comes from. Of course there's soykafty telemetry and glowie stuff, but I doubt most people give a soykaf and it's not like you're gonna convince them otherwise.

>>68154 1/5 bait, you can do better.

lol at autistic person whose company I enjoy mod taking OPs opening paragraph as defending crap instead of quoting defending crap. typical.

>The problem is that a lot of security researchers who claim to support privacy recommend proprietary software and demonize open source. and this problem will never be solved until open source stops being insecure garbage

>>68289 >Arguing that anything is secure at all How much are you paid per post? People live off of windows bug bounties, and if anything that just creates a climate for day 0s. Linux isn't secure either. Protip: Nothing is secure when an engineer is autistic enough to look closer, and Microsoft pays contractors to look closer. You really believe those people are all law abiding, wholesome good guys that would never, ever use their persistent leverage to leverage persistence? Moreover, if it's not open source, how are these bug bounty contractors finding bugs without access to the source? Answer that question and you'll understand why everyone is laughing at you.

>>68295 advertised bug bounties dont always pay out like implied, do you know these people who live off ms windows bounties? linux isnt as slapdash amateur as you seem to think, there's a lot of companies that pay a lot of engineers to work on linux. still, lot of security mistakes are between the screen and the chair.

>>68296 >Linux isn't as amateur as you think I never condemned either individually, I condemned both as equivalent. Windows however creates a culture of risk; Linux a culture of exploration. Source is irrelevant to this argument >B-b-but you don't have access to windows source code.... Let's focus on that, because if you don't know why, your opinion means so very little.