What is your desktop OS?

Majesticharmony

Majesticharmony
Btw, I am same as "airplanelasagne", seemingly having accidentally created two accs on different devices.

ClickClickDrone

Majesticharmony And if Linux was completely insecure against any "nontrivial" attack, it would affect systems way beyond desktop use.

Everytime I have used the word "Linux" in this thread, I've specifically meant desktop Linux.

I apologise for not being clear.

Majesticharmony They (especially the networking stack) exist on non-desktop use cases as well. Including ChromeOS.

Of course, but on servers, WLAN controllers are usually (at least I do) disabled because Ethernet is superior for unrelated reasons, reducing attack surface over the air.

Majesticharmony The madaidan article is making that claim. So far, the "progress" has been glacial at best.

Well, I really don't have any interest in what's getting written in the Windows kernel since I don't use it.

Majesticharmony

ClickClickDrone

Everytime I have used the word "Linux" in this thread, I've specifically meant desktop Linux.

But if someone ask which practical concerns make Linux too risky to use on desktop, and you answer "desktop Linux", it does not make any sense.

ClickClickDrone

Majesticharmony
You misinterpreted my answer, it seems.

What I meant with that reply was that most of the issues I've outlined is critique for the bogstandard desktop Linux distributions e.g., Ubuntu, and many (but not none) issues are not applicable to significantly hardened Linux server OSes.

TL;DR: I bring up the issues with standard desktop Linux, not hardened Linux distros for servers, e.g., Alpine.

Majesticharmony

ClickClickDrone
Servers usually use regular Linux distros, like Ubuntu, Debian or RHEL. For example, Wikimedia runs their infrastructure on Debian. Alpine is popular for many Docker containers due to its low overhead.

ClickClickDrone

Majesticharmony
Well, with the exception of RHELatives, those are bad choices out-of-the-box, but the key difference here is that servers of e.g., Wikimedia, have experienced sysadmins in charge of administrating these servers and know how to harden them.

That is in contrast to the standard Linux desktop where the average user doesn't possess these skills. (even many of those with more technical know-how!)

And, to bind it all together, mainstream Linux for desktops, which, in-large, has no sound in-depth hardening out-of-the-box as already explained, along with everything I wrote above which I won't repeat, is thus incredibly insecure by default. The final nail in the coffin is the unacceptable levels of hardening to make it reasonably secure, but even then, it is like building a house on top of quicksand...

Majesticharmony

ClickClickDrone
More like "potentially less secure against certain attacks" rather than "incredibly insecure".

Carrousel7956

ClickClickDrone what would you recommend for servers? Can I run docker on GrapheneOS?

ClickClickDrone

Majesticharmony
It is incredibly insecure per my longer replies above.
However, in the right hands by experienced sysadmins it may become somewhat reasonably secure.

That does not change the fact that, as mentioned, even after proper hardening, the whole building is built upon an incredibly fragile foundation.

Anyway I will conclude that neither of us will ever come to terms regardless, so perhaps, instead of @tux_, @airplanelasagne (your alt account I suppose), and you continuously derailing the thread, it'd be better to close this chapter and let moderators clean up any misinformation from both sides.

ClickClickDrone

Carrousel7956 what would you recommend for servers?

Alpine Linux is excellent. Afterwards, then OpenBSD is preferred if you don't need Docker.

Carrousel7956 Can I run docker on GrapheneOS?

Yes, but what's the use-case?

s94

A hardened vanilla Arch installation with the niri compositor + Dank Linux seems pretty good.

Install sbctl + limine for secure boot if your computer supports it.

tux_

ClickClickDrone What this author has to say about Linux security is irrelevant. He has not uncovered anything that isn’t already obvious or has been known for decades. For example, at the very start:

"The traditional application security model on desktop operating systems gives any executed application complete access to all data within the same user account."

This is by design, it's not a "flaw." This is how the UNIX/Linux model is intended to work. Data is protected by creating separate users account. This is the security paradigm that critical programs exposed to the Internet such as Nginx, Apache, Postfix, Dovecot, DBs, etc., have followed for decades, with an excellent track record. This mechanism is usually sufficient, but it is possible to go further with chroot jails, and some of the programs mentioned above do that too. In essence, Docker/Podman and others "containerization" strategies just build on these primitives and package them in a user-friendly manner.

Security mechanisms exist, but beyond basic user control, they are generally opt-in. A barebones Arch or Debian config does not configure a network firewall, for example, because often it isn't needed and these distributions do not make assumptions. Security beyond basic user management is basically opt-in. The job of making assumptions on behalf of target users lies with the distributions.

de0u

tux_ "_The traditional application security model on desktop operating systems gives any executed application complete access to all data within the same user account._"

This is by design, it's not a "flaw." This is how the UNIX/Linux model is intended to work. Data is protected by creating separate users account. This is the security paradigm that critical programs exposed to the Internet such as Nginx, Apache, Postfix, Dovecot, DBs, etc., have followed for decades, with an excellent track record.

That is an "ambient authority" model. It was pretty good when it was designed in 1970, but hasn't held up so well since then. For example, in 1983 the U.S. DoD issued the "Orange Book" criteria, which require much more than ambient authority in order to score well. Modern operating systems include various sorts of restriction systems and capability systems (SELinux, capsicum). Increasingly, processors are moving away from ambient authority within a single program, adding things like PAC, MTE, and even, experimentally, capability systems like CHERI. And meanwhile people are rewriting code from C and C++ into Rust.

None of these changes are happening because people want to make extra work for themselves. They're happening because 1970's ambient-authority systems are insufficient to address modern threats, such as sandbox escape, privilege escalation and hypervisor escape.

Earlier in the conversation I provided examples of privilege escalation, which makes 1970's-era separation by user i.d. irrelevant (de0u). It's not clear to me how it makes sense to keep talking about using user i.d.'s as a sole or even primary control mechanism given the wide availability of privilege escalation vulnerabilities. And there are other serious threat classes, such as hypervisor escapes (example).

ryrona

I think it would be prudent to again highlight that whether Windows, Linux or MacOS is the more secure desktop operating system heavily depends on your own threat model.

For example:

Windows uploads a copy of your disk encryption key to Microsoft servers for safe-keeping. They clearly state this in their documentation, and the purpose is of course to aid law enforcement. This might be perfectly fine for a company that needs to protect company secrets, but to an activist, this may very well mean there is effectively no disk encryption at all on Windows. Linux on the other hand implements strong disk encryption, and your keys are never stored or uploaded anywhere, being suitable for all threat models.

Windows also scans all files on your device, to remove anything inappropriate. Files may also be uploaded to a Microsoft server for staff to be able to inspect it further, if the file appears potentially problematic to the scanner. The official purpose is to remove malware, but they can scan for anything they want, and it is not possible to disable this scanning, unless you are a company paying for an enterprise license. I cannot imagine this scanning being acceptable even for companies, and definitely not for individuals, although companies apparently can buy themselves out of it, for now. Linux on the other hand do not scan at all, so suitable for all threat models.

Linux security is poor against remote exploits, I would even say very poor. Only reason few actually get compromised is because they aren't an interesting target to begin with, and attackers don't want to use their zero-days exploits again anyone and everyone, because it will be detected and the vulnerability exploited will be patched, burning their useful zero-day. Is the Windows kernel marginally better than the Linux kernel at resisting exploits against network drivers? Maybe. Does it mean Windows may be a better choice for some people with some threat models? Absolutely. But I think for the vast majority of people frequenting these kinds of forums, Linux would be a much better choice, because Linux is at least not obviously malicious against you.

Best would of course be if people used QubesOS, assuming warranted by their threat model, since that is an actually secure operating system, way ahead of any of the others mentioned.

gamma7

ryrona

ryrona Windows uploads a copy of your disk encryption key to Microsoft servers for safe-keeping. They clearly state this in their documentation, and the purpose is of course to aid law enforcement.

Can uploading be disabled or avoided?

ryrona Windows also scans all files on your device, to remove anything inappropriate. Files may also be uploaded to a Microsoft server for staff to be able to inspect it further, if the file appears potentially problematic to the scanner. The official purpose is to remove malware, but they can scan for anything they want, and it is not possible to disable this scanning, unless you are a company paying for an enterprise license.

Does this mean that LTSC versions of Windows allow users to turn off file scanning?

IndigoMizumi

While I was dual booting Windows 10 LTSC alongside Linux Mint for a while I have recently gotten rid of Windows completely. Now I'm running only Linux Mint on my desktop. There weren't very many applications keeping me tied to Windows anyway, and what I can't run natively works well enough on Wine.

ryrona

gamma7 Can uploading be disabled or avoided?

According to the information I have, which is from Microsoft, it is only on Home licensed versions of Windows 10/11 the automatic uploading of the disk encryption key happens, and only if you login to your Microsoft Account during first setup of a freshly installed version of Windows.

Logging in to a Microsoft Account is mandatory on at least all Home/Pro versions, I don't know about others. It cannot be skipped in the UI. You need to connect to internet and then either create an account or login to an existing one. However, this is possible to bypass by unplugging the network cable, refusing to connect to a Wifi, and instead at the internet setup screen press Ctrl+F10 to open a terminal, and then type "oobe\bypassnro" and press Enter. The first time setup wizard will restart, and this time around there will be a tiny button at the bottom of the internet setup screen that says "I don't have access to internet" which you can click to instead setup a local account. This will however disable disk encryption completely, with no possibility to enable again, leaving all your data unencrypted, so you will have to use a third-party disk encryption software instead if you need disk encryption, such as VeraCrypt.

On Pro licenses it is possible to setup disk encryption using the built-in BitLocker functionality, without any key being uploaded to any Microsoft Account, allegedly. I would not trust this.

On Enterprise licenses it is possible to enable actually secure disk encryption modes in BitLocker that cannot be broken by skilled attackers. This should give comparable security to using third-party disk encryption tools such as VeraCrypt. In theory. But given that they think uploading the encryption key is okay at all, I would be hesitant to trust this.

Really, just use VeraCrypt instead, and pray they won't start detecting and uploading VeraCrypt keys too.

Or better, switch away from Windows if Microsoft or law enforcement is in your threat model.

gamma7 Does this mean that LTSC versions of Windows allow users to turn off file scanning?

In theory it should be possible to disable the scanning on Enterprise licensed versions of Windows, including the LTSC edition. You will need to edit Group Policies using the administrative tools. Look up guides for how to do it, if you really need to use Windows despite such scanning being in your threat model.

bounding

Fedora :)

grayway2

ryrona just use Shift-F10
then start ms-cxh:localonly to skip the Microsoft account requirement. You're automatically redirected to create a local account.

I disable automatic sample submission to avoid windows defender to send files to Microsoft servers.

Bitlocker if configured properly is secure. Only local accounts on the machine. Recovery key stored in encrypted form. No trust in the TPM to protect your PIN during pre-boot authentication. Use instead a strong password.

Bitlocker is easily defeated because it's generally tied with a Microsoft account, no pre-boot authentication, the recovery key is in plain-text on a USB flash drive or because the computer was not turned off.

wuseman

Amateur-Explorer OpenBSD > GrapheneOS > MacOS > Securebue and Qubes > Fedora Silverblue and Windows 11 LTSC(privacy.sexy) > standard Linux distribution

What? Why would you put MacOS before Qubes OS? Why would you put OpenBSD before GrapheneOS?

Literally nothing makes sense here.

« Previous Page Next Page »