Linux and bsd insecurity - using qubesos or windows - macos?

these links put me in a bit of a crisis. is the stuff explained in here correct? besides qubesOS, is running windows or macOS (with telemetry blocked and or disabled of course) actually more secure than running linux or bsd like it's suggested here? https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/security-privacy-advice.html https://web.archive.org/web/20220227172102/https://madaidans-insecurities.github.io/openbsd.html https://web.archive.org/web/20221206091251/https://grsecurity.net/~spender/exploits/exp_moosecox.c https://old.reddit.com/r/GrapheneOS/comments/bddq5u/os_security_ios_vs_grapheneos_vs_stock_android/elgl6xt/

The BSDs will always be behind because of lack of devs and less eyeballs on the code. Its known already that MacOS and Windows have several security advantages over Linux and the BSDs but those systems violate user privacy. Because Windows, MacOS, and Linux have many more users, bugs are identified and eliminated quickly whereas they persist for longer on the BSDs. This will prove fatal as BSDs loose more market share to Linux. Now, Linux is fairly safe but does not have many of purpose built operating systems. This is known already. A system is only as safe as you use it and to the extent that it meets your needs. If you are a freedom fighter resisting a tyrant oppressor regime, then Windows and MacOS are not a good idea because these companies will cooperate with governments and routinely violate user privacy. In that case, a Linux or BSD system may be better even if they have shortcomings that Windows and MacOS do not have.

These are very good no-nonsense resources. The Linux/Openbsd security community is full of cargo culting (including this board sometimes), and the name of the game for security has been isolation and sandboxing for over a decade. But this doesn't mean you should switch to windows. Nobody using windows actually wants to use UWP and windows sandbox, so it puts it only marginally above apparmor and selinux in terms of real world benefit. The main issue is the whole system is opaque so we don't know how much is just security by obscurity instead of actually providing protections, maybe there are some extremely easy ways to bypass the sandboxing, not to mention Windows having just a historically really bad reputation with pushing bloat onto users against their consent and treating them as a product in general. MacOS actually has really good security across the board, the only flaw that I can think of is as far as I know the clipboard isn't handled as securely as qubes for example. It still has the transparency issue, and although Apple is considered a pretty good actor it could be a problem for those not wanting glowieware in their computer and I ideologically don't like accepting a trillion dollar company's closed source solution. Using flatpak or VMs are probably the two most practical solutions for getting actually good security on Linux. There are distributions dedicated towards using flatpak as a sandboxing environment for absolutely everything which could probably be reasonably secure without having to commit to Qubes. You could also DIY your own fix with bubblewrap but this takes a lot more work. I haven't used OpenBSD but jails seemed interesting, so maybe its an actually good option ...? How well does it isolate things like clipboard etc. in the real world?

>>25544 MacOS uses some code from FreeBSD as well as at one point in past hired FreeBSD devs and Windows now has WSL so there is a bit of blurry overlap. With Microsoft vs Apple id place my bets on Apple, they seem to put more effort into being less privacy invasive and puts up at least some resistance to government before giving up if legal requirements or pressured under threat enough, meanwhile Microsoft actively develops programs for police and federal agencies and I doubt any government workers are using Macbooks, they all use Windows so they are more familiar with how to use it too. Likewise you wont find many big companies using MacOS so it's not the most appealing target for hackers who want to make large gains. Apple even started making it so it's more difficult to install any program that doesnt come from a developer deemed as trustworthy. Though I don't trust the current CEO Tim Cook as much as Steve Jobs, while Jobs was clearly a sociopath that is worthy of mistrust he also was paranoid and likely developed MacOS to be suited to his personal needs. The guy even constantly bought new cars to get around a legal loophole so he could get by not having a license plate. Plus Tim Cook tried to push the whole hash check on iOS devices before massive backlash over it. Generally speaking wouldn't microkernels and hybrid kernels be safer than monolithic kernels? Or is monolithic kernels being more sensitive to faults make them harder to exploit without crashing the whole system before they accomplish anything? If so then is DragonflyBSD's kernel and MINIX the best in open source options in this regard for what to focus off of building on?

>>25547 Yes, developers at Apple contribute code to FreeBSD and this is an advantage for that project over other BSDs. Apple has at times resisted requests from US federal agencies but they have also cooperated with law enforcement in more recent years. Government workers and the US military don't use Macbooks because they don't come with ethernet ports, which is a requirement for all government devices, otherwise they likely would use them and I've heard of federal workers buying them and having to return them because they didn't know about the ethernet requirement. I don't think Jobs used computers or any Apple tech in his daily life all that much, the same way many social media CEOs don't let their children use their own platforms. He probably used them less than the average person. He seems the type of person who'd be fine with selling poison to others but wouldn't dare use it himself. I'm not sure if Microsoft is better than Apple. MacOS has some good features and is the most user friendly Unix operating system but its also expensive and a walled garden that violates user privacy. Its best not getting bogged down in debates over which cooperation is better, since all large multinational cooperations are monopolistic, greedy, and power hungry. Apple doesn't compete in the same markets or sell the same kinds of products as Microsoft and the difference in business models is probably what accounts for their behavior. Never trust any cooperation. I would assume that microkernels and hybrid kernels have advantages over monolithic kernels because they are smaller and provide better isolation between components but I am not very knowledgeable on this topic.

>>25543 > these links put me in a bit of a crisis. Well, that's not great. > is the stuff explained in here correct? Seems legit. I'm not an expert, though. > besides qubesOS, is running windows or macOS (with telemetry blocked and or disabled of course) actually more secure than running linux or bsd like it's suggested here? "Linux" is a kernel, not an operating system like Windows or MacOS, but I'll assume you mean one of the more mainstream distributions such as Ubuntu or Debian. Regardless, there may be cases where Windows and MacOS have better security measures than Linux and BSD systems, and vice versa. In order to answer your question, you need some definition of a threat model. What are you defending against, who are you expecting to attack you, and so on. >>25544 puts it best: > A system is only as safe as you use it and to the extent that it meets your needs. I also really like a line from this talk on OpenBSD security[0] (from memory, not an exact quote): > People in the OpenBSD community tend to see a feature or mitigation and cheer instead of analyzing if the mitigation is useful or needed. That quote has the same sentiment as this one[1]: > On a separate note, defensive security folks, and Apple in particular, loooooove mitigations. On iOS, Apple has lately been slapping proprietary mitigations around like there’s no tomorrow. But thing is, mitigations are often delicate creatures, with rather fragile assumptions. Having too many of them in one place can easily make them break one another Besides that, people in the security community tend to be rather snobby with each other, for lack of a better term. This may be their personalities bleeding into their work, or they may feel the need to defend their work or attack other's. For example, one researcher said the following[2]: > A bunch of masturbating monkeys https://www.openbsd.org/papers/cuug2019-predictable.pdf Finally, it's worth noting that if someone has you in their sights as a target, it is not a matter of if you will be pwnd, but when. There's a story about a journalist who was targeted after making contact with Edward Snowden and agreeing to publish some of the leaks that's very revealing in that regard[3]. If you want something that works out of the box, try QubesOS. If you want to feel like you have more control over your system and what it does, try hardened Gentoo with SELinux. If you want absolute computer security, throw away your computer entirely. Make peace with the fact that you will never have "perfect" security, as even if you craft a system that is touted by all to be the most secure in the land, someone can kidnap you and beat you with a wrench until you cough up the secrets. Find security measures that are solid enough to protect you from realistic threats yet permissive enough for you to live your life and implement them. In so many words, I recommend QubesOS, or hardened Gentoo (with optional SELinux), simply because I dislike trillion dollar corporations and their closed-source, spyware-laden solutions. Again, I am not a security engineer, so you may feel differently. >>25545 > MacOS actually has really good security across the board, the only flaw that I can think of is as far as I know the clipboard isn't handled as securely as qubes for example. It still has the transparency issue, and although Apple is considered a pretty good actor it could be a problem for those not wanting glowieware in their computer and I ideologically don't like accepting a trillion dollar company's closed source solution. It is worth noting that Apple has been vulnerable to side channel attacks in the past. See iLeakage[4], a Spectre-like attack on A-series or M-series CPUs[1] and GoFetch, a side channel attack targeting cryptography keys in memory[5]. I can't speak to the security of MacOS as I am not a qualified security engineer. One of the founders of QubesOS had nice things to say about the direction Apple was taking with their security [6]. > although Apple is considered a pretty good actor it could be a problem for those not wanting glowieware in their computer and I ideologically don't like accepting a trillion dollar company's closed source solution. I agree. > How well does [OpenBSD] isolate things like clipboard etc. in the real world? Unsure, ask the developers, I suppose. >>25548 > Yes, developers at Apple contribute code to FreeBSD and this is an advantage for that project over other BSDs. I don't mean to be rude, but could you provide a source for this? This isn't a criticism, I'm just curious, is all. [0] https://isopenbsdsecu.re/ [1] https://isopenbsdsecu.re/quotes/ [2] https://twitter.com/uid1000/status/1138398314486013952 [3] https://www.theatlantic.com/magazine/archive/2020/06/edward-snowden-operation-firstfruits/610573/ [4] https://ileakage.com [5] https://gofetch.fail [6] https://twitter.com/rootkovska/status/1136217887440625664#m

>>25543 What >>25549 said is very important. >if someone has you in their sights as a target, it is not a matter of if you will be pwnd, but when Security on digital devices are not a magic shield. Even if your devices run the most secure operating system in the world this doesn't make you safer. In the guerrilla and organized crime worlds, skilled operators avoid using digital devices, switch them often and limit what they write down. Hamas successfully evaded Israeli SIGNIT by using runners and a simple self-enclosed telephone network. Bin Laden never left his house and never connected his simple Windows PC to the internet, and he evaded multiple intelligence agencies for over a decade. I read about one anti-apartheid activist in South Africa never left his house, never made a phone call, and never wrote anything down when he was put under heavy surveillance for months and he successfully evaded capture. Do you need to be as paranoid as these people? Probably not and if you were in their situation you wouldn't be lugging around a smartphone or a laptop everywhere. OpenBSD might not be as secure as its fans claim it is but its not insecure so there is no reason to panic. If you want to escape surveillance capitalism, protect your information, and use a computer, then in these cases Linux or BSD are perfectly fine as long as you know how to use them properly and they meet your needs.

>>25548 > Government workers and the US military don't use Macbooks because they don't come with ethernet ports, which is a requirement for all government devices, otherwise they likely would use them and I've heard of federal workers buying them and having to return them because they didn't know about the ethernet requirement. I have a family member who was in the US government not the ones people here would be worried over though. I cant recall if his laptop had an ethernet port it likely did because it was a thick laptop but when he logged into his government account at home it was over wifi not ethernet. > MacOS has some good features and is the most user friendly Unix operating system but its also expensive and a walled garden that violates user privacy. Back when Apple was using Intel chips they had s custom version of IntelME with some of the features removed because they were concerned it took too much information. So some things they did with hardware was better than most companies at the time. About cost, Hackingosh exist. Basically just unofficially and technically illegally patching the MacOS to work on other hardware. In past what Mac users would do is use something like LittleSnitch to monitor what connections are being made and control that and it informs when webcam is in use. I am not sure if this still works now or not. >>25549 >source Not that Lain but there are commit messages to FreeBSD from "Apple Inc." and that really is them not someone impersonating the company.

i am the first to admit that i started using unix likes out of ease of hacking and the missing telemetry more than anything else, and i followed what seemed the most credible advice on security (because i still don't want to have the security of a 90s OS of course) and probably many people are like me in this regard, so it's hard to find out who's in the right and who's not when even the main developers throw soykaf on 'the other side' (both linus and theo are apparently assholes, mickay apparently too and had to step down from grapheneOS etc..) just like >>25549 above said: >Besides that, people in the security community tend to be rather snobby with each other, for lack of a better term to me it feels like this is putting it gently

naive normal person blogposts, if you're new and clueless it's better than nothing >proprietary >secure you literally cannot know what it does, how many explicit backdoors are built in >exploit mitigation 99% of hacks happen because idiot clicks the exe, not by exploits, for the paranoid there's vm and physical separation ms, apple upload so much to data brokers by default, which plebs legally agree to, that device security is a moot point, read the EULA mfer how many get pwned because of linux+vm or qubes, you can run malware on purpose in those by the dozen and be fine try doing crime on mobile and other proprietary platforms, see how it goes

>>25549 >I don't mean to be rude, but could you provide a source for this? Not a huge amount from what I can see. https://cgit.freebsd.org/src/log/?qt=author&q=%40apple.com

>>25577 Probably because MacOS and BSD have diverged a lot over the years. Early OS X was a mix of NetBSD, FreeBSD, and bits of OpenBSD with a kernel developed from Mach. Today only a few userland utilities and bits of kernel code are from BSD so Apple doesn’t need the FreeBSD guys anymore.

>>25563 You humongous retard just stop talking