(untitled)

Today, I read this site, https://itvision.altervista.org/why.linux.is.not.ready.for.the.desktop.current.html This site explains me about how Linux's security is worse than other major OS. Absolutely, Windows' security is better. Because it had more experienced fighting malicious programs. But I can't, Because It has most users in major OS and this makes Windows become a largest target. So I decided to stay in Linux, But how can I make my Linux more secure? Should I disconnect from Internet? What can I do my best?

>>17677 Security and isolation on monolithic kernel systems is a joke and will never work because ambient authority without any real isolation is inherent to their design. Software also cannot be assumed flawless, so it will remain vulnerable. Regardless how much Windows might try to isolate software, the attack surface from a single compromised program is simply too large to meaningfully guarantee anything. Qubes is the best we've got until seL4 and genode get going enough (and Qubes could just move to use those as its backend instead).

>>17678 Then how about selinux? Does that actually work well like people choosing fedora cuz it's preinstalled selinux?

>>17679 SELinux can still be bypassed by additional bugs. It helps, but ultimately it's patching holes in what can best be described as a gigantic sieve.

>>17678 >Qubes is the best we've got until seL4 and genode get going enough (and Qubes could just move to use those as its backend instead). Sounds interesting. How many years do you think will that take?

> microkernels Why isn't GNU Hurd more actively developed? https://www.gnu.org/software/hurd/ https://www.gnu.org/software/hurd/microkernel/mach/gnumach.html >>17677 >https://itvision.altervista.org/why.linux.is.not.ready.for.the.desktop.current.html Also read the UNIX Hater's Book.

>>17683 because Urbit is . rather than redesign the stack , start by redesigning the language .

start by making an internationally neutral programming language like APL except with a minimal instruction set which can constitute more abstract languages , like the relationship Nock has to Hoon .

>>17677 I mean, security is a fickle thing. All operating systems are vulnerable to some degree, and often in very specific ways unique to their userbase. For example, social engineering attacks have traditionally worked best on MacOS users, since their entire threat model revolves around trusting their computer to handle security. Windows machines are best gamed when you engage in guerrilla warfare, turning the OS against it's user. Again, the average Windows user really only worries about what they download/install, and the rest is supposedly "just default". Linux is in a decidedly different position. For starters, your attacker will almost always be familiar with Unix above anything. Moreso than MacOS or Windows attackers, your box gives them the homefield advantage as much as it gives you one. On top of that, almost every Linux installation is wildly different, meaning that it's basically impossible to "harden" a Linux distribution in any meaningful way. Like they mentioned upthread, your best option to assuage this paranoia is using a system like Qubes. Qubes isn't a practical solution for most Linux users though, so I'd advise spending some time thinking about your own threat model. The biggest disadvantage Mac and Windows users have is hubris, which you can easily escape as a Linux user. Understand the vulnerabilities of your system and work around them as best you can. Assume that your threat actor knows more about your system than you do. Don't neglect hardware mitigations, either: throw a password on your BIOS, encrypt every drive with LUKS, and perhaps consider immobilizing devices when they aren't in use (Kensington locks are quite cheap nowadays). These are all sane options for reducing your attack surface and helping you sleep at night. Ultimately though, yes, Linux has much worse security than MacOS and Windows. As was also mentioned upthread, a monolithic kernel being maintained for both server and desktop use will have monumental security conceits to keep the updates moving at a reasonable pace. The upside of this is that your computer is vastly more extensible than your average NPCs. "Security through obscurity" is still a helpful adage to live by, especially if your adversaries are Glowies.

>>17683 GNU Hurd isn't exactly focused on being a security microkernel for one, and the base it chose to build its microkernel on is also pretty contentious among the microkernel crowd (it's definitely not the most performant).

>>17684 Given it requires Ethereum blockchain and therefore probably also always requires networking like Windows 11, I'm not interested.

>>17684 holy soykaf, I haven't heard urbit in yeeeeears I still get emails from them lmao

>>17678 >>17686 But wouldn't Qubes be targeted because Snowden publicly recomended it?

>>17713 So? Everything is targeted, especially things which purport to aid security and privacy. Sanity of the design and code is therefore primordial.

>>17707 They seem more alive than ever. They just did a conference. Stars are increasing in value. Maybe there is something to it. Not sure how the security compares to anything though...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I have read over the points presented by the article. Many of the points are totally moot or look at how products external to Linux relate to Linux from the wrong perspective. A non-trivial number of the concerns expressed are valid but lack the light of greater understanding. Some of the points raised boil down to "I don't like that this is so" yet don't point out any actual problem. As someone with over 20 years of operating systems including but not limited to Unix (OpenSolaris, illumos, OpenBSD) and Unix-like (countless GNU/Linux distros) experience, macOS, and Windows in environments ranging from out-in-the-field offensive security, startups, and strict and enterprise environments. Nowadays much of my focus is on DoD-compliant architecture on major cloud providers and FedRAMP compliancy for both cloud and bare-metal (private-cloud) deployments in datacenters. I have run BSD or GNU/Linux on the desktop (laptop) by conscious choice or more specifically out of sober recognition of the necessity to protect the integrity of the services I have provided for my clients or organizations I have served. When you know people who have real money (not the guy in the nicer neighborhood who drives a bmw, but REAL money) you can't fuarrrk around. If running a right-angled USB cable from the side of my laptop to a USB-attached WiFi chip broken open and soldered to a custom antenna mounted on the back of my laptop's display is what I need to do to avoid running a mini PCI-E WiFi card with binary blobs on it that is what I am going to do. There are many of us out there that use our computers for accomplishing real-world work that actually matters, contrast to those who are more preoccupied with sucking cock. There is much pragmatic real-world perspective missing from this article. A simple example is "I want my Nvidia card to work", to which a valid counterpoint is "when Apple packages a Macintosh desktop for you, does Apple choose a very exactly sourced GPU from the most cooperative vendor with a very exact PCI-ID or does Apple pull whatever random card retailed on NewEgg that EVGA shat out?". If you want to be an adult using any operating system you don't buy random soykaf hardware with uncertainty that a decent operating system will just take whatever soykaf hardware you happened to buy, you by the hardware for the software you want to run and not the other way around. Nothing in the article presents a legitimate claim against Linux' security model nor how Linux desktop applications are secured in real-world practice. Anyone who knows what they are doing with https://firejail.wordpress.org on Linux with a sane kernel configuration (any popular distro stable kernel) will be totally fine. I will post a more thorough response to this thread in the near-future. Some of the points made in the article are legitimate and those will be addressed. The less-than-sophisticated points in the article will also be addressed. -----BEGIN PGP SIGNATURE----- iHUEARMIAB0WIQQyudGgHG89KhA6eKaAyah5Errk5wUCYYec3QAKCRCAyah5Errk 58zsAP93eCiBpJEHOa3TNMiWOm/jaLrGRpcXjQAGzJ7AaHTfJwD+Lev3uacvzwCl Zx8izV+VhFkpUBuYYXACLCmB330BsuE= =0x+J -----END PGP SIGNATURE----- A base64-encoded copy of the message + signature above and the public key are in the two base64-encoded strings below. LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLQpIYXNoOiBTSEEyNTYKCkkgaGF2ZSByZWFkIG92ZXIgdGhlIHBvaW50cyBwcmVzZW50ZWQgYnkgdGhlIGFydGljbGUuICBNYW55IG9mIHRoZSBwb2ludHMgYXJlIHRvdGFsbHkgbW9vdCBvciBsb29rIGF0IGhvdyBwcm9kdWN0cyBleHRlcm5hbCB0byBMaW51eCByZWxhdGUgdG8gTGludXggZnJvbSB0aGUgd3JvbmcgcGVyc3BlY3RpdmUuICBBIG5vbi10cml2aWFsIG51bWJlciBvZiB0aGUgY29uY2VybnMgZXhwcmVzc2VkIGFyZSB2YWxpZCBidXQgbGFjayB0aGUgbGlnaHQgb2YgZ3JlYXRlciB1bmRlcnN0YW5kaW5nLiAgU29tZSBvZiB0aGUgcG9pbnRzIHJhaXNlZCBib2lsIGRvd24gdG8gIkkgZG9uJ3QgbGlrZSB0aGF0IHRoaXMgaXMgc28iIHlldCBkb24ndCBwb2ludCBvdXQgYW55IGFjdHVhbCBwcm9ibGVtLgoKQXMgc29tZW9uZSB3aXRoIG92ZXIgMjAgeWVhcnMgb2Ygb3BlcmF0aW5nIHN5c3RlbXMgaW5jbHVkaW5nIGJ1dCBub3QgbGltaXRlZCB0byBVbml4IChPcGVuU29sYXJpcywgaWxsdW1vcywgT3BlbkJTRCkgYW5kIFVuaXgtbGlrZSAoY291bnRsZXNzIEdOVS9MaW51eCBkaXN0cm9zKSBleHBlcmllbmNlLCBtYWNPUywgYW5kIFdpbmRvd3MgaW4gZW52aXJvbm1lbnRzIHJhbmdpbmcgZnJvbSBvdXQtaW4tdGhlLWZpZWxkIG9mZmVuc2l2ZSBzZWN1cml0eSwgc3RhcnR1cHMsIGFuZCBzdHJpY3QgYW5kIGVudGVycHJpc2UgZW52aXJvbm1lbnRzLiAgTm93YWRheXMgbXVjaCBvZiBteSBmb2N1cyBpcyBvbiBEb0QtY29tcGxpYW50IGFyY2hpdGVjdHVyZSBvbiBtYWpvciBjbG91ZCBwcm92aWRlcnMgYW5kIEZlZFJBTVAgY29tcGxpYW5jeSBmb3IgYm90aCBjbG91ZCBhbmQgYmFyZS1tZXRhbCAocHJpdmF0ZS1jbG91ZCkgZGVwbG95bWVudHMgaW4gZGF0YWNlbnRlcnMuICBJIGhhdmUgcnVuIEJTRCBvciBHTlUvTGludXggb24gdGhlIGRlc2t0b3AgKGxhcHRvcCkgYnkgY29uc2Npb3VzIGNob2ljZSBvciBtb3JlIHNwZWNpZmljYWxseSBvdXQgb2Ygc29iZXIgcmVjb2duaXRpb24gb2YgdGhlIG5lY2Vzc2l0eSB0byBwcm90ZWN0IHRoZSBpbnRlZ3JpdHkgb2YgdGhlIHNlcnZpY2VzIEkgaGF2ZSBwcm92aWRlZCBmb3IgbXkgY2xpZW50cyBvciBvcmdhbml6YXRpb25zIEkgaGF2ZSBzZXJ2ZWQuICBXaGVuIHlvdSBrbm93IHBlb3BsZSB3aG8gaGF2ZSByZWFsIG1vbmV5IChub3QgdGhlIGd1eSBpbiB0aGUgbmljZXIgbmVpZ2hib3Job29kIHdobyBkcml2ZXMgYSBibXcsIGJ1dCBSRUFMIG1vbmV5KSB5b3UgY2FuJ3QgZnVjayBhcm91bmQuICBJZiBydW5uaW5nIGEgcmlnaHQtYW5nbGVkIFVTQiBjYWJsZSBmcm9tIHRoZSBzaWRlIG9mIG15IGxhcHRvcCB0byBhIFVTQi1hdHRhY2hlZCBXaUZpIGNoaXAgYnJva2VuIG9wZW4gYW5kIHNvbGRlcmVkIHRvIGEgY3VzdG9tIGFudGVubmEgbW91bnRlZCBvbiB0aGUgYmFjayBvZiBteSBsYXB0b3AncyBkaXNwbGF5IGlzIHdoYXQgSSBuZWVkIHRvIGRvIHRvIGF2b2lkIHJ1bm5pbmcgYSBtaW5pIFBDSS1FIFdpRmkgY2FyZCB3aXRoIGJpbmFyeSBibG9icyBvbiBpdCB0aGF0IGlzIHdoYXQgSSBhbSBnb2luZyB0byBkby4gIFRoZXJlIGFyZSBtYW55IG9mIHVzIG91dCB0aGVyZSB0aGF0IHVzZSBvdXIgY29tcHV0ZXJzIGZvciBhY2NvbXBsaXNoaW5nIHJlYWwtd29ybGQgd29yayB0aGF0IGFjdHVhbGx5IG1hdHRlcnMsIGNvbnRyYXN0IHRvIHRob3NlIHdobyBhcmUgbW9yZSBwcmVvY2N1cGllZCB3aXRoIHN1Y2tpbmcgY29jay4KClRoZXJlIGlzIG11Y2ggcHJhZ21hdGljIHJlYWwtd29ybGQgcGVyc3BlY3RpdmUgbWlzc2luZyBmcm9tIHRoaXMgYXJ0aWNsZS4gIEEgc2ltcGxlIGV4YW1wbGUgaXMgIkkgd2FudCBteSBOdmlkaWEgY2FyZCB0byB3b3JrIiwgdG8gd2hpY2ggYSB2YWxpZCBjb3VudGVycG9pbnQgaXMgIndoZW4gQXBwbGUgcGFja2FnZXMgYSBNYWNpbnRvc2ggZGVza3RvcCBmb3IgeW91LCBkb2VzIEFwcGxlIGNob29zZSBhIHZlcnkgZXhhY3RseSBzb3VyY2VkIEdQVSBmcm9tIHRoZSBtb3N0IGNvb3BlcmF0aXZlIHZlbmRvciB3aXRoIGEgdmVyeSBleGFjdCBQQ0ktSUQgb3IgZG9lcyBBcHBsZSBwdWxsIHdoYXRldmVyIHJhbmRvbSBjYXJkIHJldGFpbGVkIG9uIE5ld0VnZyB0aGF0IEVWR0Egc2hhdCBvdXQ/Ii4gIElmIHlvdSB3YW50IHRvIGJlIGFuIGFkdWx0IHVzaW5nIGFueSBvcGVyYXRpbmcgc3lzdGVtIHlvdSBkb24ndCBidXkgcmFuZG9tIHNoaXQgaGFyZHdhcmUgd2l0aCB1bmNlcnRhaW50eSB0aGF0IGEgZGVjZW50IG9wZXJhdGluZyBzeXN0ZW0gd2lsbCBqdXN0IHRha2Ugd2hhdGV2ZXIgc2hpdCBoYXJkd2FyZSB5b3UgaGFwcGVuZWQgdG8gYnV5LCB5b3UgYnkgdGhlIGhhcmR3YXJlIGZvciB0aGUgc29mdHdhcmUgeW91IHdhbnQgdG8gcnVuIGFuZCBub3QgdGhlIG90aGVyIHdheSBhcm91bmQuCgpOb3RoaW5nIGluIHRoZSBhcnRpY2xlIHByZXNlbnRzIGEgbGVnaXRpbWF0ZSBjbGFpbSBhZ2FpbnN0IExpbnV4JyBzZWN1cml0eSBtb2RlbCBub3IgaG93IExpbnV4IGRlc2t0b3AgYXBwbGljYXRpb25zIGFyZSBzZWN1cmVkIGluIHJlYWwtd29ybGQgcHJhY3RpY2UuICBBbnlvbmUgd2hvIGtub3dzIHdoYXQgdGhleSBhcmUgZG9pbmcgd2l0aCBodHRwczovL2ZpcmVqYWlsLndvcmRwcmVzcy5vcmcgb24gTGludXggd2l0aCBhIHNhbmUga2VybmVsIGNvbmZpZ3VyYXRpb24gKGFueSBwb3B1bGFyIGRpc3RybyBzdGFibGUga2VybmVsKSB3aWxsIGJlIHRvdGFsbHkgZmluZS4KCkkgd2lsbCBwb3N0IGEgbW9yZSB0aG9yb3VnaCByZXNwb25zZSB0byB0aGlzIHRocmVhZCBpbiB0aGUgbmVhci1mdXR1cmUuICBTb21lIG9mIHRoZSBwb2ludHMgbWFkZSBpbiB0aGUgYXJ0aWNsZSBhcmUgbGVnaXRpbWF0ZSBhbmQgdGhvc2Ugd2lsbCBiZSBhZGRyZXNzZWQuICBUaGUgbGVzcy10aGFuLXNvcGhpc3RpY2F0ZWQgcG9pbnRzIGluIHRoZSBhcnRpY2xlIHdpbGwgYWxzbyBiZSBhZGRyZXNzZWQuCi0tLS0tQkVHSU4gUEdQIFNJR05BVFVSRS0tLS0tCgppSFVFQVJNSUFCMFdJUVF5dWRHZ0hHODlLaEE2ZUthQXlhaDVFcnJrNXdVQ1lZZWMvUUFLQ1JDQXlhaDVFcnJrCjV6NU9BUUQ2U3ZzVVpnOGZWVzNjS1ZCRmxsdnUxZTFlOVpFSlRjZXIrZVZpSFpyT2pnRCtMa2paMC9NVzBrcDQKNXNnZHRtTUYzYWFLS2dDUDJVeE9xb0ZYdm1WZVVkYz0KPXE3djEKLS0tLS1FTkQgUEdQIFNJR05BVFVSRS0tLS0tCg== LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgptRThFWVllWDJCTUZLNEVFQUFvQ0F3Um1HNEJRWFlwYnhlS28zTzZzQjVQNHhxQkZEWldUN1NSVGU0Rlltb2tRCkxrWmZCOXQwNTd0T0F6N0dIL3duMVZsSGNFRExkTk1XTHoyOUhhZFVlcVFodENGVmJtbDRJRWx1WkhWemRISnAKWVd3Z1UzbHpkR1Z0Y3lCVmJteHBiV2wwWldTSW1nUVRFd2dBUWhZaEJESzUwYUFjYnowcUVEcDRwb0RKcUhrUwp1dVRuQlFKaGg1ZllBaHNEQlFrRHdtY0FCUXNKQ0FjQ0F5SUNBUVlWQ2drSUN3SUVGZ0lEQVFJZUJ3SVhnQUFLCkNSQ0F5YWg1RXJyazU2a0JBUUNMUFE5TU02RWlhMlRXVy9SUC8yaXhBZXYvc2dzRnJZdmRCZ0pzbzMxU3h3RC8KYVpJUUh0dDBTOGxpYzlMU2tyN3A4VmZ1M3VMUXpZTTg2STJRRE4zNXVDTzRVd1JoaDVmWUVnVXJnUVFBQ2dJRApCR1FjZVlhWmZFNVBOeTEydElaTzdZaHczdnZMbmdnZDZoeFVreloyanppMFBPeGcwTkRtWUFndkR5TDJTb2ZJClpQYmQ3bHBoL0NrK3l4aXgrM2U0djNrREFRZ0hpSDRFR0JNSUFDWVdJUVF5dWRHZ0hHODlLaEE2ZUthQXlhaDUKRXJyazV3VUNZWWVYMkFJYkRBVUpBOEpuQUFBS0NSQ0F5YWg1RXJyazV4azFBUDlKaWM4d2p3b2U2MFNGVDQvVApxbEtncmUrK1hiNTdNd0VNWE9DeEovZkJ2Z0VBMDh3d2dpTkliM2NHY243SXdpS3FMNVJ1Z0tLdjRESHhITDBGClRtTktTZlk9Cj1ld2dsCi0tLS0tRU5EIFBHUCBQVUJMSUMgS0VZIEJMT0NLLS0tLS0K

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The correct URL for Firejail is https://firejail.wordpress.com/ and not https://firejail.wordpress.org -----BEGIN PGP SIGNATURE----- iHUEARMIAB0WIQQyudGgHG89KhA6eKaAyah5Errk5wUCYYeeRwAKCRCAyah5Errk 59lEAQD56M69Hng3qdcy+hMTWDKJ0FdOqydQPEOTEgzemYEhJwD/dBgt8d62D8mL C3UoB+zXLbz9NoN0Sq5b7BvWzGNo1Ig= =/3Hr -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Now that I am finished fully reading the article I am moderately disappointed that I spent time reading it. The author of the article is transparently geek-squad tier in technical proficiency and IT relevance. The auther has some very serious misunderstandings about how GNU/Linux and other operating systems are used in the real-world outside of environments no more sophisticated than a community college as encountered by IT help desk. Put simply, the article is midwit tier to the max. I am responding to the article for the benefit of those who had the misfortune of being exposed to the article. I do have real work to get done right now but as promised I will in the near enough future post a full response to the article on this thread. -----BEGIN PGP SIGNATURE----- iHUEARMIAB0WIQQyudGgHG89KhA6eKaAyah5Errk5wUCYYejgQAKCRCAyah5Errk 5y7FAPoCIEIIH6N5nqYFyNsGDyYuGTSCU0xS4zXQIJ0hYjyIIgEA3CL7NEkYbtHb 1G71yj5x3RYQ5MiQiavNRBtinYxh0OA= =KuIS -----END PGP SIGNATURE-----

Why must lainniggers fall for obvious bait so hard?