this post was submitted on 08 Apr 2024
21 points (65.7% liked)
Privacy
32120 readers
310 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Server security is not completely same as desktop one, Linux kernel is spaghetti code with very large attack surface, only reason it's not exploited more is Linux Desktop is not as lucrative target as Windows, Proper sandboxing doesn't exist and is half assed, Qubes is the only one properly doing sandboxing on Linux
OpenBSD and Qubes seems best solution so far but neither are ideal
Qubes doesn't address Linux's security problems it just sandbox/virtualize them and it requires beefy hardware
Fedora Silver Blue doesn't do anything special really it's your normal linux distro just immutable and relies on flatpaks (On another note Flatpaks sandbox are easy to break and most programs don't use it properly)
It would be much more lucrative to exploit the Linux servers, Android (based on Linux) phones, embedded Linux devices,... than that tiny niche of Windows desktops could ever be.
Linux servers exploit is different than Linux desktop exploit and 1000% different than exploiting Android
It's general misconception that Android is just Linux but it's not, it's like saying Linux is just GCC compiler
You already said that openbsd has pros and cons. I'm not sure how you get to the conclusion that it's better overall than linux at the same timr as stating that it's behind linux.
https://lemmy.ml/comment/10078459
This is the comment. There was a duplicate which is why I deleted it. Somehow you answered to the one I deleted.
Anyway, I was refering to secure blue, not silverblue.
Your criticism about flatpak implies that the user installs the malicious app in the first place. Just don't. As dumb as it sounds but the user can be the best antimalware shield. Just don't install crap. Facebook is tracking you? Don't install it. Look at xz, and how well it was detected and how quickly everything was fixed. Don't install unknown software. Use trusted sources. Listen to other people. Flatpak is in a good path. I'm not sure why criticing it leads to abandoning instead of improving it.
I am not native English speaker so sorry for misunderstandment
I didn't say it's overall better
I said even though on base level OpenBSD is much more clean and secure than Linux it lacks or lags behind Linux in adding mitigations for security vulnerabilities
And there are far less eyes on OpenBSD so many vulnerabilities don't get discovered in first place
Any software can be malicious even essential ones just look at recent Xz vulnerability (And it was discovered by sheer chance), OS should have systems in place like proper sandboxing, permissions (Not half baked one like flatpak) ...
Many Flatpaks bundle libraries which aren't available in any runtime. There have been cases of non-malicious Flatpaks (on Flathub) containing known vulnerable versions of libraries. Is a user expected to cross reference a Flatpak's manifest with known library vulnerabilities before installing it?
Flatpak's "sandbox" (more of a container really) also breaks internal sandboxing mechanisms used by some other apps notably Chromium-based browsers (they use some hack to use Flatpak's sandbox instead but I doubt it is as secure).
Flatpak is not a security tool, it is a software distribution tool (Edit: BTW, the Flatpak project doesn't even claim to be about security).
Let's improve flatpak, instead of abandoning it :)
Personally I don't see the harm in abandoning Flatpak, the technologies developed to support it (bubblewrap, desktop portals and the secure contexts Wayland protocol to name a few) are far more important and can be used independently.
I think Flatpak has the potential to be good, if distros use it as their primary package manager with a sane (not Flathub) repository (Fedora has a well maintained Flatpak repo, for example). Otherwise, for the average user, installing a Flatpak from Flathub when there is a distro package available might seem like a good idea because they heard about sandboxing, but in many cases it will actually be more secure to just use the distro package.