MacOS vs Linux for security and privacy

02673853

argante Privacy – none of them. Rather, choose some BSD. Apple sees everything you do. Many Linux distributions also implement telemetry, so you'll have to verify this yourself.

Do you have any source supporting your claim that major distribution are sending telemtry, please use sources that also state WHAT telemtry

slink

02673853 as an example, fedora. It's to my knowledge opt-in, and clearly disclosed.

NetRunner88

02673853
Mostly they ask your packages installation/usage

02673853

NetRunner88 02673853
Mostly they ask your packages installation/usage

How do you want to install packages from remote server without telling them that you want to do so?

n3t_admin If you don't even know how to update your system, Linux is not for you. No amount of hardening commands is going to improve this situation.

You are mostly right but I want to add that its easily is possible to use Linux without typing a single commend

akc3n

EDIT: Cleaned the comments hijacking OP's thread. Please stay on topic moving forward.
Thanks to the community members that flagged harmful advice comments and AI generated replies.
Reminder to that we do have a Code of Conduct; if you see that there is an issue, feel free to ping me or contact me (info in my profile bio).

~~Locking for now until this thread gets cleaned up as time permits.~~

For those using generators to post comment replies, yes, we have a way of detecting certain characters, please stop. Or if you are using it for translating, please add a note in the footer of your comment.

See https://discuss.grapheneos.org/d/11951-ai-generated-text-is-forbidden-with-the-exception-of-automated-translation

ubersecure

KCne Intel ME and AMD PSP provide really useful security features and using things like Libreboot or Heads can severely damage security

Well, that's fine if you don't mind a nation state actor having full remote access to your system.

akc3n

ubersecure a nation state actor having full remote access to your system.

Citation needed.

akc3n

NetRunner88 akc3n
...
Every research on the web with Intel+ime+exploit give tons of infos

... There is a specific reason I asked them:

akc3n

ubersecure #44 a nation state actor having full remote access to your system.

Citation needed.

ubersecure

argante The most researched is probably Intel ME. It's a specially crafted version of the MINIX operating system. You can easily find laptops with coreboot and IME disabled (only a small part loads to boot).

So what is your recommendation for privacy?

My understanding is that HEADS is the closest thing to GOS/Android Verified Boot on a PC.

I figure the most private would be HEADS + QubesOS.

argante

ubersecure So what is your recommendation for privacy?

Heads only gives you the illusion that your hardware hasn't been compromised. I've described what can be done above. If you want Qubes, check out this link.

Regarding privacy, that's a completely separate topic, but the most important thing is to change your habits. You don't have to be constantly online, your phone doesn't have to check your email every few seconds, and so on.

ubersecure

akc3n Citation needed.

They don't publish their exploits.

I've seen both Tails OS and QubesOS systems remotely compromised. It's up to you what to believe.

I'm not aware of any other known potential avenues that could explain such exploits, so my best guess is Intel ME.

NetRunner88

akc3n

https://hackaday.com/tag/intel-management-engine/

Every research on the web with Intel+ime+exploit give tons of infos

https://www.theregister.com/2017/11/20/intel_flags_firmware_flaws
https://m.slashdot.org/story/333555
https://www.trendmicro.com/en_us/research/17/k/mitigating-cve-2017-5689-intel-management-engine-vulnerability.html
https://www.bankinfosecurity.com/backdoored-in-30-seconds-attack-exploits-intel-amt-feature-a-10583
In German also
https://www.heise.de/news/34C3-Details-zum-Intel-Management-Engine-Hack-3928301.html

n3t_admin

ubersecure any other known potential avenues that could explain such exploits, so my best guess is Intel ME.

???? So we stopped having kernel level bugs and other OS CVEs all of a sudden? The probability that there are bugs somewhere in the kernel or GNU utils or something, is a LOT higher than assuming the system was somehow compromised via Intel ME. There is zero evidence that hints at this and pure speculation on your part.

ubersecure

n3t_admin ???? So we stopped having kernel level bugs and other OS CVEs all of a sudden? The probability that there are bugs somewhere in the kernel or GNU utils or something, is a LOT higher than assuming the system was somehow compromised via Intel ME. There is zero evidence that hints at this and pure speculation on your part.

Could that explain TailsOS being remotely compromised?

I am claiming this can be done because I've seen it (as you said, I'm offering zero evidence).

I'd be interested in evaluations by security experts on the matter. I did quite a bit of research after what I saw a couple years ago, but didn't find anything too satisfactory: None of them have reported what I have seen.

On the other hand, Intel ME is widely considered to potentially allow full remote access.

ubersecure

ubersecure Could that explain TailsOS being remotely compromised?

OK. I did some searches on kernel level vulnerabilities, which are regularly patched.

I'm talking about completely taking over the system, not just some information leaks though...

n3t_admin

ubersecure okay, what does "take over the whole system" mean? Those aren't technical descriptions, so I assume you are more or less a layman in this field. There is a plethora of possibilities with rootkits, bootkits, simple VNC style control, a billion possibilities of some type of RCE...

You have to forgive my curiosity, but at least once a week someone comes to this forum and creates a post with the craziest story: Hacks that "only they can see", battery usage indicating that the NSA is inside their phone and other wild shit they come up with, ...

MOD NOTE: Redacted flagged reports of inappropriate phrase. Reminder to all, please check out our Code of Conduct.

Of course in layman terms and without any evidence, where it's clear they can't differentiate between a buffer underflow and a use-after-free.
So when someone claims a remote Intel ME exploit - we are all ears to hear how this could have been pulled off, because this is one of those rare Stuxnet moments.

ubersecure

n3t_admin okay, what does "take over the whole system" mean? Those aren't technical descriptions, so I assume you are more or less a layman in this field. There is a plethora of possibilities with rootkits, bootkits, simple VNC style control, a billion possibilities of some type of RCE...

You have to forgive my curiosity, but at least once a week someone comes to this forum and creates a post with the craziest story:

Well, I have numerous "crazy stories" over the years (but not lately, since I switched to a MacBook over a year ago: though I'm sure I still have no privacy online). I don't expect anyone to believe me.

I'll give you one example of TailsOS being "taken over": I left Tails running overnight while a large file was downloading. Then I turned off the system in the morning.

The next time I plugged in the Tails USB and started it, I got the Debian 11 welcome screen. The only OS on the USB was now a fresh Debian 11 install (all of my data was gone). The USB was labelled (so not a mistaken USB drive), and anyhow I have never downloaded Debian 11 in my whole life.

NetRunner88

02673853
There is plenty mirrors managed from various institutions.
You can even have you own mirror. So..

02673853

NetRunner88 02673853
There is plenty mirrors managed from various institutions.
You can even have you own mirror. So..

Yes, I only meant that I don't consider this telemtry because its obviously somehow necessary

NetRunner88

02673853
It is not necessary

02673853

NetRunner88 02673853
It is not necessary

If you want to get or update package you need to tell this to the server providing them

argante

KCne Intel ME and AMD PSP provide really useful security features and using things like Libreboot or Heads can severely damage security

Thanks for the very valuable link. Here's a more readable version.

I agree with everything they wrote. I agree that heads and PureBoot are inherently pointless. The only thing missing here is the realization that the world doesn't end with their arguments.

Let me give you a simple example that will relate to the logic presented in this article. Let's say you're locked in a prison for particularly dangerous criminals. You have a single cell without a window. You're constantly monitored by cameras. You can only go for a walk while handcuffed and never in contact with other prisoners. You're constantly monitored by guards. Do you realize that you're one of the safest people in the world? You're completely safe from any risk. But would you sacrifice your sense of freedom for such uncompromising security?

Many people love to experiment with operating systems and BIOSes. It used to be common for people to compile Linux kernels and modify the entire system. Today, with systemd, we're just silent, passive consumers. Disabling IME and coreboot restores that old feeling of being the master of your hardware.

You don't need LibreKey/Nitrokey or heads to validate the BIOS and operating system. All you need is a small hardware-encrypted USB drive with a read-only switch. Install a custom version of the Linux kernel with basic tools, your own statically linked copy of mtree to scan system files, and a flashrom for BIOS validation. If you're feeling paranoid, you can initiate system boot from such a hardware-encrypted USB drive.

GrapheneOS

argante You're describing fake security measures which do not work.

GrapheneOS

argante

Could you explain and justify this further?

Okay, we'll do that below, but we're close to removing the thread now. It's wasting the time of the project and it's filled with misinformation

modifying an old x230 laptop

This is the direct opposite of a secure device.

meaning, instead of OpenSMTPD, I have smtpd from the usr.sbin/smtpd repository

Doesn't support authenticated encryption (DANE or MTA-STS) among other things. It can't do it natively or via external implementations.

argante

You don't need LibreKey/Nitrokey or heads to validate the BIOS and operating system.

These don't do that in the first place.

All you need is a small hardware-encrypted USB drive with a read-only switch.

Even if you're fully booting off this, it doesn't protect the firmware and other state on the device.

Install a custom version of the Linux kernel with basic tools, your own statically linked copy of mtree to scan system files, and a flashrom for BIOS validation.

You can't meaningfully validate anything in these things this way. It depends on the incorrect assumption that you have a secure way to chain trust to what's on this USB drive and that scanning things that way would be secure which it isn't.

ubersecure

argante Heads only gives you the illusion that your hardware hasn't been compromised. I've described what can be done above. If you want Qubes, check out this link.

Interesting suggestion! Yes, I've used Qubes.

ubersecure

argante arding privacy, that's a completely separate topic, but the most important thing is to change your habits. You don't have to be constantly online, your phone doesn't have to check your email every few seconds, and so on.

not sure what you mean.

If an adversary has direct access to your hardware through Intel ME, you have no privacy: They can see anything you do on that system.

« Previous Page