Gentoo Developer: Is The Linux Desktop Less Secure Than Windows 10?

[starshipeleven]

I also wouldn't count on Windows ASLR:

If you listen to the grsecurity guy, also Linux's ASLR is pretty much pointless, btw.

[wizard69]

Scary stuff, I'm switching back to Win 10 now!
Seriously, though, Those are pretty serious exploits and it's good they are being addressed.

Stay away from Windows please. We have to sue that stuff at work and it sucks bad. You are just as likely to have your machine crash from a MS bug than a virus. Personally for "desktop" like usage I use a Mac and Linux for everything else. While some turn up their nose to Mac OS it is a fairly complete UNIX platform and supports good apps in way Linux doesn't do well.

[starshipeleven]

And wtf are you talking about? Ask the developer of program x why he wants root access. It's your own fault and noone else's if you grant it to any app. It's not in the scope of the kernel to decide what's better for you.

You have all the freedom to restrict anything you want. Or - if you believe it or not - don't run untrusted code.

Yeah right. Why more modern systems like say Android or iOS let me install applications without requiring root access? And that even if they are in the most hostile environment for a digital device without any sign of antivirus software they didn't suffer hilarious malware-related issues like Windows is well-known for?

The whole concept of requiring root to install shit is a dumbfuck idea stemming from the dumbfuckest idea of all that you just said "the user knows enough to decide".

This might have been true in the 80s, but nowadays this is rarely true even for linux veterans, how in the hell you know how that a specific program won't harm you (apart from getting it from the distro's repositories and hope that its maintainer actually ran some tests and bad shit slipped in unnoticed)?

[wizard69]

I could never believe that Linux desktop is secure or more secure than Windows.
The major thing that protects Linux desktop is it's marketshare.

Not really! There is an active community of developer in the Linux world and not all of them are in possession of their halos.

The only software that I think is secure is Virtualbox (not the program itself but the OS and programs that runs inside it).
I trust Virtualbox because I can run whatever I want inside a virtual machine and I'm not afraid that it will affect my host OS.

I don't understand why no Linux distribution gives me the power to control the program I run on it

Are your serious? You can install and uninstall as you please on most distributions.

Every time a program asks for my root password I fear that it will break my system completely, maybe it wants to format all my hard drives and I lose all my personal files.
Why the fuck the OS doesn't say why the program requires root access is beyond me.

Actually this brings up two issues.

First why are user apps accessing what should be system resources or spaces.

Second It might not be possible to explicitly detail every directory about to be touched but apps that do have to latch on to these resources should be able to tell the system what they are about to do. Either that or have the system do a dry run to make sure nothing gets trampled.

This is one thing that Apple did well with Mac OS and even the Homebrew guys to great care with their package management system. You can pretty much update anything at anytime and have no worries that something will corrupt the system. I routinely run HomeBrew, Mac OS and even Eclipse updates at the same time.

Yes, yes, everyone says to install only open source programs, but I don't need only open source programs.
There's no protection for proprietary programs.

Open source isn't any more secure than closed source. It is still easy to get something through that exposes your system before it is caught by the community.

I don't understand why Linux doesn't tell why the fuck a program wants my root access?

The bigger question is why installs are going into such areas in the first place.

When it comes to privacy, I can't control which programs are allowed access devices like Webcam and mike, DVD drive, pendrive, etc...
Everything is allowed by default.
How is that secure

That is a distro issue in my mind. However part of it is also wanting systems that just work.

I don't agree with everyone of your points but Linux really needs to rethink how the system is structured and how use apps are installed.

[wizard69]

not really. device access goes through polkit rules. you can change polkit rules.

most distros configure them to allow access for everything that seat user does (the user logged in locally).
that's also the point of the article. distros run dangerous crap by default.

Yep! In many cases solutions to these problems exist. In an effort to entice the "user" community they have played fast and easy with security.

[ArchFanatic]

If you care about Security u should run Windows 10, if you care about Privacy & Performance u should use linux...

[wizard69]

Yeah right. Why more modern systems like say Android or iOS let me install applications without requiring root access? And that even if they are in the most hostile environment for a digital device without any sign of antivirus software they didn't suffer hilarious malware-related issues like Windows is well-known for?

I really believe it the Linux community ever wants to be taken seriously on the desktop they need to look at the solutions found in things Like Android, IOS and Mac OS. None of these are perfect by the way but as you note installing an app never clobbers the entire system. Hell with HomeBrew I can install all sorts of open software on my mac and never damage the system.

The whole concept of requiring root to install shit is a dumbfuck idea stemming from the dumbfuckest idea of all that you just said "the user knows enough to decide".

he obvious problem here is that the suer doesn't know enough to decide. Even more advance users fall short of the breath of knowledge to make the right decision about installing stuff.

This might have been true in the 80s, but nowadays this is rarely true even for linux veterans, how in the hell you know how that a specific program won't harm you (apart from getting it from the distro's repositories and hope that its maintainer actually ran some tests and bad shit slipped in unnoticed)?

You don't. Back in 2008, when I decided to buy a Mac instead of trying to build up a Linux laptop, i did so because of the frustration that updates caused. That could have been updates form a package manager for the running distro or an entirely new distro. Either way things broke way too often. I don't have that problem on a Mac and can update just about everything without worry. The only thing that is a real problem is that some Homebrew apps will break with a major system update but these are few. While hilariously bad I've even done updates with out backing up the system. Linux and Windows especially are terrible in this regard.

[starshipeleven]

I don't understand why no Linux distribution gives me the power to control the program I run on it
Every time a program asks for my root password I fear that it will break my system completely, maybe it wants to format all my hard drives and I lose all my personal files.
Why the fuck the OS doesn't say why the program requires root access is beyond me.
Yes, yes, everyone says to install only open source programs, but I don't need only open source programs.
There's no protection for proprietary programs.
I don't understand why Linux doesn't tell why the fuck a program wants my root access?
When it comes to privacy, I can't control which programs are allowed access devices like Webcam and mike, DVD drive, pendrive, etc...
Everything is allowed by default.
How is that secure

Yeah, most OS around still use the old and broken concept of "the root user knows what he is doing".
Programs usually need root privileges because they need to be installed in places they can't access without root privileges and/or change system settings that again can't be changed without root privileges.

On Linux afaik the program that gets root access isn't the program itself but the package manager though (for most packaged software), and that is reading config files and whatnot. It's less bad than on Windows where you actually give root access to the application itself on install.

The main reason is that re-spinning the whole thing is a PITA. Maybe next-gen package managers like flatpack and Snap will offer better control over that.

Apart from Android and iOS where this isn't happening and stuff is relatively compartimentalized, there is Qubes OS where it's Xen that runs the virtualization, applications run in their own little compartment, so even if they get "root" access they can't do much outside of that.

Unless there are vulnerabilities in the virtualization system. Anyway, it is quite a bit harder to make an exploit that blows through an application, the OS, and Xen all in the same shot. Anyway, Qubes OS is called "reasonably secure" by its creators.

[juno]

The whole concept of requiring root to install shit is a dumbfuck idea stemming from the dumbfuckest idea of all that you just said "the user knows enough to decide".

You do know that installers run with higher privileges when you install apps on android or iOS, right? It's the same like using a package manager, only that it doesn't ask you for a password.
If that seems like such a nice idea for you, you can always use an installation daemon and use a graphical frontend to queue packages for installation. Or you could also just install apps in your home dir. Or use appimages, flatpaks, etc. Open your eyes, maybe.

If the Android way seems so nice to you, go ahead and assign a unix user for each app. Restrict the rights, easy. Or just use android-x86. What about chromeos? Should suffice your needs, maybe?

You can also maintain your own distribution. Spread it, if people agree with you, you should have plenty users. But once and for all, don't blame the kernel, which has nothing to do with it. At all.

And that even if they are in the most hostile environment for a digital device without any sign of antivirus software they didn't suffer hilarious malware-related issues like Windows is well-known for?

You must be very blinded by ideology if you don't know about security problems due to exploits on those systems. I also never had malware issues on gnu/linux without antivirus, neither do I know from people this happened to, so I don't really get your point here. But I know plenty with basically completely useless and broken Android devices, because they don't get the updates they need. Yeah, the whole Android project, or how it is being exploited, is nothing but a joke when it comes to security concerns. But you can keep talking to yourself that it is much more secure because it doesn't ask you for a root password when installing apps
Also, av don't necessarily make the system more secure. Today's products are more likely to cause more problems instead of preventing users from harm.

Yeah, most OS around still use the old and broken concept of "the root user knows what he is doing".
Programs usually need root privileges because they need to be installed in places they can't access without root privileges and/or change system settings that again can't be changed without root privileges.

I don't know which software you use, but any sanely developed desktop application does store configuration or data in sane locations, like the user's home. If you use apps that need privileges and put trash in your entire rootfs, you should maybe consider stop using crapware and not blame the victim, your system for it

[liam]

Gnome got lots of paying enterprise customers. They have a fairly good track record of patching stuff.

KDE is left in the dark. Expect nothing but 100 embarrasing bugs if someone really cared to do a proper review. Baloo should not be used, period.

Define "lots".
Saying "more than kde" isn't a good definition.