GNU Shepherd 0.8 Released As An Alternative To Systemd

[Bigon]

It seems you can't. Original report (probably toward Ubuntu's geoclue, but the issue remained) was made in 2012 and nobody cared. To be fair, it seems someone misread the bug report and thought issue is fixed.

geoclue 2.0 has been introduced in debian (by myself) end of 2013 and the code base is completely different...

Ubuntu kept geoclue(1) on live support for some reasons, so this issue is completely different

[Volta]

geoclue 2.0 has been introduced in debian (by myself) end of 2013 and the code base is completely different...

Ubuntu kept geoclue(1) on live support for some reasons, so this issue is completely different

Problem is similar, but not just in the geoclue itself. I'm following discussion at gitlab and it looks like a deeper issue. Sorry for blaming you and your app, because it seems it's more like a Gnome Settings fault and maybe with permissions as well.

[Bigon]

I realize, but to disable it you have to have root privileges. When you disable this service and set outcome to NULL exploiting it will be harder, but still possible even without geoclue, but with current policy..

Well, as replied in the gitlab issue, you can just do `/sbin/iwlist wlp4s0 scan` on the machine to trivially get all the AP MAC addresses and signal strength (and thus the location). So IMVHO, disable geoclue solves nothing if your machine is compromised (Edit: except if you have stuff like SELinux or apparmor configured in a strict way).

OTOH, fix the fact that geoclue/GNOME is not asking the permission to get the location anymore might fix accidental leakage of information to Mozilla Location Service

[Bigon]

Problem is similar, but not just in the geoclue itself. I'm following discussion at gitlab and it looks like a deeper issue. Sorry for blaming you and your app, because it seems it's more like a Gnome Settings fault and maybe with permissions as well.

It's not my application I'm just packaging it in Debian

Pinging the correct person/assigning the but to the correct project is key if you want to have a bug fixes. So the problem is maybe similar the the root cause and the person who can fix it is not

[Volta]

Well, as replied in the gitlab issue, you can just do `/sbin/iwlist wlp4s0 scan` on the machine to trivially get all the AP MAC addresses and signal strength (and thus the location). So IMVHO, disable geoclue solves nothing if your machine is compromised (Edit: except if you have stuff like SELinux or apparmor configured in a strict way).

Yes, this should be solved somehow. Maybe limit access to this to root only and maybe network manager?

OTOH, fix the fact that geoclue/GNOME is not asking the permission to get the location anymore might fix accidental leakage of information to Mozilla Location Service

This was an original complain, but it seems it was done unintentionally.

[ssokolow]

OK, sorry for taking so long to reply. Things kept being busy.

You go way to deep in some technical details, some might matter about numbers of websites that are maybe malicious, even I don't get how cybercrime which mostly works of human hacking like phishing mails where sandboxing helps you exactly 0 if you give them passwords etc. Or at least in most cases it does not help with phishing.

A popular avenue for cybercrime is building botnets, which means you don't need access to someone's password... you just need to get persistent remote code execution on their system. Sandboxing is good for breaking the "persistent" part by making it possible for a security fix to flush out any infection that already took hold.

Botnets are then used for things like:

• Ad fraud (You have your bots wander around the web, acting like real humans, to build up a "valuable eyeballs" score in the ad network's systems, then send them to garbage sites you built where you get paid to show ads to "valuable eyeballs". (You also get to charge people for sending them "high-quality visitors" which are actually bots as part of building up that score.)
• Sending spam
• Using DDoS for extortion or to attack competing groups of criminals
• Attacking other systems without revealing your location or as a force-multiplier (eg. When you buy knowledge of an un-patched vulnerability, better to multiply the number of systems you're checking for it by a million so you can check and root as many as possible before it gets patched.)
• etc. etc. etc.

I think we have a few misunderstandings on other levels.

1. for me proprietary software by definition is melicious code, the question is just in which way. The best case is that the developer/company behind such code wants you to vendor lock-in. But because I can't look into it I have assume the worst, which means even worse things in it.

My point is that you have to pick your battles and rank your threats. Yes, everything should be open-source but it's penny-wise and pound-foolish to be so focused on companies/individuals exploiting lax laws that you don't properly address the threat of people actively breaking laws they don't fear. Sandboxing helps against the latter.

Maybe mentioning a known case like Sony Rootkit was a bad idea because [...] While against cyber criminals I have at least the state behind me to fight against them, Nobody will help me to fight against the state or other states.

If a state actor is going after me, the big threats are:

1. Passive data acquisition (The NSA was hugely against SOPA and PIPA because they knew that threatening piracy would prompt encryption of traffic to become commonplace. Likewise, last I heard, they were building a huge data center to archive everything that flows through U.S. Internet backbones so they can try to decrypt it later when computers become more powerful.)
2. Directed attacks (Open-source software won't help if the NSA wants to spy on you. It's known that they can intercept mail and courier shipments to modify the contents, and that they can do things like hiding logging devices inside the plugs of USB cables.)

Personally, I think the biggest threat from state actors is the Intel Management Engine, AMD PSP, and ARM TrustZone, which are built into every CPU you buy these days, run closed-source firmware, have a higher permission level than any code you're allowed to install including the OS itself, and, in modern CPUs, block the CPU from running an OS if you strip them out by connecting a chip programmer directly to the motherboard.

(Intel CPUs have a watchdog timer that keeps resetting the CPU until the Management Engine boots and turns it off, the Management Engine only accepts code signed by Intel.)

Because you have to at least agree that any attempt to sandbox when the OS itself is proprietary is useless if Windows as example is a Rootkit (and with the unstoppable hidden update functionality it can be turned into that at every second by MS or any contracter of MS), so if you build on top of a rootkited system (proprietary software you have to assume that is a rootkit), is pretty meaningless? Or you say it's fine that this companies and spy agencies have a permanent rootkit towards me.

Oh, certainly, but the CPU itself has a much more attractive mechanism for state actors to rootkit.

If you're not running something like one of the POWER systems by Raptor, then worrying about state actors is a very ineffective way to decide how to allocate your efforts toward making your system more secure.

(I can't afford a Raptor system at the moment, but you can see why I'm in no hurry to upgrade off my pre-PSP, pre-UEFI AMD system when it meets my needs just fine.)

You then mention that a guix user vs a Granma situation is different. Well then let's start to aknoladge that if you use a opensource OS in the first place then maybe Sandboxing becomes more relevant, before it's more or less meaningless.

Not true. Sandboxing is important on closed-source OSes because Microsoft or Apple or Google aren't going to just say "OK" if cybercriminals walk up and ask to be let in the way they will if the NSA walk up with a legal writ. Different threats have different things which are or are not effective against them.

Then let's talk about the Internet, and Javascript. I hate the Internet or more precise the Web, not primary because of security reasons, but because it forces Interfaces on me and that I can't use native clients. So like with imap where I have a choice of interfaces (clients) I have none for a forum like this or news websites like this or webshops, I must use their web interfaces, sometimes they give proprietary apps for android as alternative, which even very basic services like the german train system monopoly company has only proprietary apps.

So that means that when I want to write here besides some hacks where I can copy the text to emacs and when I am done back into that field, but I can't read your comment in the layout I want like in my email client and I can't get in my email client your Text and answer it with pressing "F" and C-c C-c or with my custom setup Menu + e + e to send it away.

You won't see me disagreeing. I wish forums would offer an NNTP bridge so I could read and reply in Thunderbird.

Sorry that is slightly off topic but I think it has relevance why the Web as it self has to go to hell and it should not be the focus to make the web more secure but to get rid of it in the current form. (which would mean that you have OPEN not in opensource but in nobody has to ask for a api key and sign a contract for it, apis and standardisation so that you don't need a special client for each specific website but 1 app for forum 1 app for newssites 1 app for webshops etc) with protocols like imap.

Except that:

1. The web has too much inertia for you or me to get rid of and the convenience of it is the only thing preventing companies from pushing mobile-style apps on desktop users.
2. I'm talking about technologies that work equally well for web or native applications. Again, even the best open-source developers make mistakes and overlook things.

I'm focused on practical improvements in the life I experience, not ideals which would require me to become the next Richard Stallman or Gandhi to make a difference.

Hell and try to contain it with sandboxes instead of fixing it is the wrong aproach that is like using virus scanners in windows instead of fixing security bugs faster like it was done in linux and therefor only for servers virus scanners were a thing, even at times where people were more positive about that kind of software.

Sandboxing is like using flame-retardant materials in construction. It's not a substitute for firefighters; it's an effort to reduce the chances of a blaze starting and to minimize the damage that happens before they arrive.

There will always be human programmers making mistakes.

[...]

Which brings us to:

https://www.gnu.org/software/librejs/

[...]

https://www.gnu.org/software/librejs...ipt.html#step3

The point is that a developer then has the source code (correctly formated for humans to read) and can than maybe even use the same compiler to see if the used code on the website is the same. (differently formated) That gives people a way to find insecure websites faster even if they use or pretend to use free JS. Because 1. you can check is it really opensource automatically (librejs might do that automatically at least optionally), and B then look at the human readable version of the source.

[...]

I'm not against the idea, but, again, that doesn't protect against well-intentioned human making mistakes which are then exploited by malicious individuals. That's what sandboxing helps with.

because how you want to make Nvidia and Gaming companies that release games on Steam to force them to use Sandboxes is also questionable

I don't remember saying anything about forcing gaming companies. What I remember saying is that games are very well-suited to sandboxing since any software design that could also run on a console is inherently pretty self-contained already.

(eg. For the hard drive, games generally only need access to their own files and a place to store save files while most other kinds of applications will want an Open/Save dialog and the ability to let you choose where to put documents of some sort.)

Heck, games running on a console are getting ever more sandboxed in order to make it as hard as possible to use bugs in them as a springboard for gaining the root access needed to run pirated copies of games.

sure I guess valve could try to make them but this companies have other optionns, so it would be the common user that forces them into that. Sure you can argue that you don't need games but you need web pages sure but I even wonder how you can bring in the Nvidia Blob into a sandbox if that is the solution to make it secure or how that would technically even be possible.

Sandboxing isn't a binary "if you don't sandbox everything, it's useless" thing. My point is to sandbox as much as possible because, the more you sandbox, the harder it is for an attacker to find a way to compromise your system in a persistent way.

Focusing on the nVidia binary driver as a problem with sandboxing is as ill-suited to the reality of today's situation as focusing on the Sony rootkit. The nVidia binary driver is the only noteworthy piece of closed-source kernel code on Linux, while the vast majority of attack vectors are through userspace code.

Sure you can say don't use Nvidia then, but that aknolages also that the opensource part is the important part

It's an important part. As I keep saying, open-source isn't magic fairy dust. LWN.net has a list of discovered security vulnerabilities in open-source packages.

So can we at least agree that on OS level freesoftware / OS is more important or nessesary that sandboxing can mean any real security at all?

No, we can't agree, because it fundamentally depends on what kind of threats you're trying to protect against. You're focused on state threats, where open-source is the best protection as long as your CPU isn't bypassing it with a built-in exploit. I'm talking about the attack vectors that don't require state backing to gain access to, which show up in open-source software too, and which sandboxing is very helpful for.

If you use any proprietary games sandboxing will not help, and you can't force them to use sandboxing or at least very difficult, while I think it's easier to force webmasters to use only free software JS, and have a website where you audit and white list them.

Well there were games like SimCity (2013) but others that had big problems with deep os level modifications welle very securom or whatever this drm things are called now do horrible stuff, and could they do that if it would be opensource you would only just use a fork of it and remove such behaviour, with opensource that would be a possibility and sure you maybe can't then connect to the official servers but simcity is a good exampe because you need with the original client to be connected to the servers to play a single player game which you could easily get rid of if you had the source and therefor easily have a save clone. Well I don't know how helpful it is to talk about games but I would argue that such forced online connection you can't make harmless with sandboxing if nothing else they spy location data on you with it and no sandboxing can fix that, but source code would not automatically sure but it would be esay to remove the online code for good and have a functional single player game.

Last I checked, Linux game DRM doesn't install kernel modules, so it's much more within the read of a company like Valve to have the Steam client provide sandboxing as an option and provide some kind of financial incentive to companies to turn it on. (eg. Maybe take only a 29% cut of the profits rather than the usual 30% cut.)

As for the DRM-free stuff offered by places like GOG.com, that's easy to sandbox using existing options like Firejail.

Would GOG's DRM-free release of Stellaris be a sufficiently mainstream example?

I only started playing Stellaris recently, so I haven't played a whole game through regardless of sandbox or no sandbox, but this seems to work flawlessly and would be comparable to how Steam would set up a sandbox:

# ~/.config/firejail/stellaris

# Deny access to everything in $HOME except what it needs
# (Exempt it from anything generic.profile may do and whitelist it)
noblacklist ~/.local/share/Paradox Interactive/
whitelist ~/.local/share/Paradox Interactive/

# Turn on the standard set of protections most profiles want,
# like "noroot", "seccomp", and "caps.drop all"
include /etc/firejail/generic.profile

# If I were running a Firejail newer than what comes with a 2016 Kubuntu LTS,
# I should be able to just whitelist the Stellaris install directory in /mnt like I
# did the save directory rather than having to trim away my non-standard,
# non-read-only additions outside $HOME
blacklist /srv
blacklist /mnt/buffalo_ext
blacklist /mnt/incoming
blacklist /mnt/red6/backups
blacklist /mnt/red6/games_todo
blacklist /mnt/red6/stuff_to_prune
blacklist /mnt/red6/stuff_to_read

# Deny network access (I only play Stellaris single-player)
net none

$ # NOTE: --profile only needed because I didn't feel like renaming start.sh to stellaris
$ firejail --profile=$HOME/.config/firejail/stellaris /mnt/red6/games/stellaris_2_6_1_1_36932/start.sh

Firejail also includes utilities to automate the process of editing your .desktop launchers to work via it.

even if you would be right fine for a securtity focused OS that might be matter then make a security linux distro if not tiles then a server focused version of tails

Arguing that it's what we have now or something like tiles or tails is silly. We might as well be back on MS-DOS with that attitude. Security is not a black-and-white thing.

if you belive in that form of security fine but so far most people use windows therefor you will not convince the majority so why care if you can win other guix users to your security philosophy why should exactly they give a shit about security in your way, when nobody else does?

If they would advertise on their website that they are a very secure of security focused distro I could see that discussion so it just seems a bit random.

That's sort of like saying "Most people run Windows 95/98, so why run Linux on our server or upgrade Mac users to MacOS X when it won't make them more secure?"

Thankfully, the people making the open-source ecosystem you champion so vehemently see things differently and are working diligently to add security and sandboxing even as you dismiss it.

[blackiwid]

Thankfully, the people making the open-source ecosystem you champion so vehemently see things differently and are working diligently to add security and sandboxing even as you dismiss it.

Apparently not else Guix would NOT use this C based in your view insecure Init system and every other distro that use the C based Init systems. Also your comparison with most people run windows therefor you should also run windows is a false comparison, one is what you do, and again pick your best tails or whatever Distro and one is what 3rd party does you try to tell a 3rd party what to do... that are 2 completely different things, and maybe you say you don't want to do that, but you defended the person that wanted to did that.

I see a few flaws with your argument,
1. sure criminals can do some effective attacks but most of that attacks are meaningless. Yes the numbers are high but it's a shotgun approach 99% don't lead to real damage. Like with my dad downloading some botnet thing on android, the provider detects it, he finds out which device it is worst case shuts down the infected device and somebody has to find the problem.
2. I don't see how that could be fixed, it's not that the android sandbox system is to bad for that, it just asks do you allow this new app to send data to the internet and every app wants to do that... and then it does... that all rights a botnet needs.

Now my arguments would probably anecdotes but if you know not 1 person in your live that got in any way damaged through internet criminality significantly but we all get permanently damaged through proprietary software every single one of us, I take this permant abuse that I live through more serious than this chinese amateurs that get nothing really done.

I mean what is the biggest thread of cyber criminality probably Indian phone callers, that make you fear and transfer money, fraud happens still 99% offline via phone or visitors.

Another thing is that I don't need software to "sandbox" I do that via hardware, just have a evil pc / console and have a clean (only opensource software) pc and you are fine from having bad software. Sure there is mass survailance which you can fight with vpn and security problems but you say the state comes to you also through firmware stuff and so on... sure but I still don't get that argument do you think sandboxing protects you from them? So here sandboxing does also not help, it helps even less against state actors.

Let's look at real software world... look at windows and macosx, because it's not opensource there are no repositories with software because the companies would not allow other websites to host their software... therefor to install software you have to go on random websites that easily can be spoofed or look nice like legit ones then you download it and install it with root rights... now you can have some sanbboxing that will ALWAYS allow more than the app is needed to do, or the allowences always can be used for something else. the allowance to send data in the internet can never be so specific that it only allows the correct data be send.

So now let's compare that with Linux here you have a central installer that only installs software from this trusted source, so as example Redhat makes sure 0 criminals post there software there? Is that 100% perfect? no? but much more than downloading from some internet site a setup.exe and hope that your blackboxing stops the rootkit you just downloaded is not doing something to bad.

Now let's look further, what is the most used hardware/software from people? Android phones, here again I have 0 knowledge of any bot-net or anything alse done with a app from f-droid, yet MANY apps from google play store had and have horrible malicious features.

So could there THEORETICALLY put malicious code in free/opensource? sure, but in reality what do we see? we see that opensource means 100% safety at least in android. Now sure a map app in f-droid will also indirectly by sending the requests generate data about you that others collect, but that is a different question, we focused on cyber criminality. Also injecting Trojan code into opensource apps I also suspect only state actors would able to do, against them both approaches don't help as if necessary they have all methods to get to you anyway.

And the way this internet botnet thing could probably be running in the first place was because I had to allow starting of apps outside of the play store because I needed to install f-droid... so if it would be a opensource OS f-droid would be preinstalled and such security mechanism would not be needed to be deactivated to have a functional system without 100% proprietary malicious code. I mean even with a central repository like f-droid proprietary world can create any safety you have then I don't now 10% horrible cyber-crime software directly hosted by google. Apple tries there to be a bit more aggressive but even their numbers are not that great.

Btw internet criminals if you are not a high value target, target always the weakest chain, so if you have a better workflow more secure systems (as example Linux) than 50% of the users or even better than 80-90% then they have no interest in you they rather attack the low hanging froot if there is plenty of those why go over the harder to get stuff? Therefor all this attacks except maybe skynet which again was a state actor are technology wise extremely pathetic. Sure the rantsome stuff with companies getting their data encrypted till they send money to somebody are more sophisticated but I think the way this system got effected must been either old windows systems (I think I heard something about that) or some stupid installing of some shit from emails or so. At least that was the way in, after having a infected pc they used probably from that machine other mechanics.

Maybe our difference is also a private person vs companies. Because for company targets more sophisticated attacks are thinkable, but for private users opensource protects you pretty well.

And for me the only way to sandbox proprietary software is run it on a different pc.

[ssokolow]

[...]

OK, I've been conversing in good faith, but it's getting pretty clear that talking to you is like arguing with a brick wall if you can't grasp the concept that things aren't black and white despite my constantly trying to get through to you.

(eg. "Apparently not else Guix would NOT use this C based in your view insecure Init system" is like saying "The fact that so many people use C rather than raw assembly language is proof that they don't care about performance optimization")

Have the last word. I've got better things to do with my time.

[blackiwid]

you can't grasp the concept that things aren't black and white despite my constantly trying to get through to you.

The same is true for you "a proprietary system that is containerized is always more secure than opensource software without containerizing".