TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Linux being secure is a common misconception

81 点作者 WallyFunk超过 1 年前

27 条评论

devit超过 1 年前
Well, the biggest advantages of Linux are that the OS vendor is not itself malicious (in particular, does not collect telemetry, push advertisements or attempt to restrict your use of the system like Microsoft and Apple do), the OS is relatively unpopular and thus not a profitable target for malware directed to end-users, and it is flexible and customizable.<p>You need to use VM-based isolation to have good security with Linux beyond that (i.e. use Qubes or a similar alternative).
评论 #38423030 未加载
评论 #38423090 未加载
评论 #38428460 未加载
评论 #38422737 未加载
评论 #38424562 未加载
indymike超过 1 年前
This line, to me, caused me to become much more critical of the article:<p>&quot;such as Windows, which is leaning heavily towards Rust, a memory safe language,&quot;
评论 #38423294 未加载
评论 #38423259 未加载
评论 #38423542 未加载
xorcist超过 1 年前
That anything is not completely secure is a truism.<p>In what way? Compared to what?<p>Linux is not as secure as some research-level operating systems, but that comparison is not very useful for most people. Among mainstream operating systems, Linux contains comparably few surprises.<p>There&#x27;s also the fact that, like with much of open source, when the developer&#x27;s interest align with yours the tools get more effective. Contrary to what you read on the Internet, most actors in the Linux ecosystem take security seriously.<p>That the article references Spengler and Micay says a lot. That&#x27;s like referencing the UNIX Hater&#x27;s Handbook. That handbook was mostly right, but also not very practical. But over time it has done more for unix than most other texts, because it was mostly read by unix developers. The situation with these guys is mostly the same. A lot of the ideas voiced by them has been the basis for new features, just not in the form they were made originally.
评论 #38423432 未加载
评论 #38423513 未加载
评论 #38423155 未加载
ramshanker超过 1 年前
“I am secure”, ohh well “Xyz is secure”, is a common misconception. Anyone remember the old saying “ given enough time and tools, all locks are broken”.
评论 #38422869 未加载
upofadown超过 1 年前
Sometimes things are secure for no particular reason. Something might not do the things you think are important for security but that does not mean that that thing is insecure. There are almost an infinite number of things you can do in the name of security. The failure to do those thing is not evidence of a problem.<p>So if you want to show that Linux is insecure you have to directly show that it is.
评论 #38434923 未加载
TrueDuality超过 1 年前
iOS being secure is also a common misconception. A bit of an extreme example but that is a meaningful problem as opposed to Linux on the Desktop cases.<p>The problems pointed out in this post are almost all around usability as Linux on Desktop. The author admits the tools exist but are hard to use in most of the cases. Where features are missing its a misunderstanding of the Linux world.<p>A lot of these protections either live under different names outside of the Windows world and the ones that aren&#x27;t don&#x27;t exist because Linux protects things in a different less vendor-lock-in way. This is very apparent in the virtual machine section which are about protecting host kernel primitives from the VM... Linux doesn&#x27;t expose _any_ host kernel primitives to the VM. The closest is narrow drivers, properly sandboxed and isolated in userspace, that are minimal and have their own security guarantees.<p>eBPF is far from a dangerous feature, C is only a dangerous language when that danger isn&#x27;t managed, and the Linux kernel is top-of-class for managing those features, there is the same root boundary issue in Windows and is a deep source of security problems (root on Linux CAN be restricted through both seccomp and SELinux policies unlike SYSTEM).<p>Things could be better for sure in the Linux world, but pretty much everything besides secure defaults here requires a level of effort or access to attack that requires full compromise of the machine already. There is much lower hanging fruit that we need to clean up and the funny thing about Linux is that it trends hard toward security and quality over time.<p>You just have to look at time to fix patches for security vulnerabilities, not just in the kernel but in any packages maintained by security distributions. The author calls out not getting patches back-ported, without looking into the patches that don&#x27;t get back-ported. RHEL won&#x27;t backport fixes for features that aren&#x27;t compiled in for example.<p>There was a post earlier this week about the CVSS scores being different between NVD and RHEL&#x27;s bug trackers... It was because the networking functionality of that package wasn&#x27;t compiled in so there was no possibility of remote execution .
timetraveller26超过 1 年前
Linux may not be totally secure but it is securest of all the viable options.
评论 #38422954 未加载
评论 #38423175 未加载
评论 #38422955 未加载
paravirtualized超过 1 年前
It&#x27;s highly unlikely that any operating system can be as secure as Qubes OS[1], simply by considering the model itself. Especially if using Whonix[2] VMs to browse the internet. It is based on GNU&#x2F;Linux and Xen.<p>Each piece of software can be separated into its own VM. It uses read only templates for the root filesystem, making it difficult for malware to persist.<p>Templates have no access to networking or hardware making it difficult for them to be compromised, AppVMs where you run software can be treated as throwaway and be trivially destroyed after each use.<p>Dom0 has no access to networking, USB devices and runs no software. Total compromise would require a hypervisor escape.<p>It is designed with the assumption that you will be owned start to finish.<p>[1]: <a href="https:&#x2F;&#x2F;www.qubes-os.org&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.qubes-os.org&#x2F;</a><p>[2]: <a href="https:&#x2F;&#x2F;www.whonix.org&#x2F;wiki&#x2F;Qubes" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.whonix.org&#x2F;wiki&#x2F;Qubes</a>
mid-kid超过 1 年前
There&#x27;s no worse way to be right than being <i>technically</i> right. Most of these points are essentially the state of the art of desktop operating systems, or pure speculation, and the fact that they aren&#x27;t perfect or widely used yet is usually because of tradeoffs that must be made in favor of usability.
cal85超过 1 年前
&gt; Due to inevitable pedanticism<p>Pedantry ;)
hackeraccount超过 1 年前
I think the two important statements which I think almost everyone would agree with are:<p>1 - against a resourceful enough opponent a networked OS being used by a human is (probably) never secure.<p>2 - the biggest insecurity in any OS is the person running it<p>3 - a knowledgeable person can use &#x2F; secure any OS to a degree that will avoid 99.99% of the vulnerabilities (excepting point 1)<p>I like Linux, I tend to think that when I want to increase security on a Linux system the tools are there and work. That said I&#x27;m sure that same thing can be said for OSX and Windows.<p>I do tend suspect that the best of the bunch - out of the box, naive user - is probably IOS. Linux is probably a close second because that naive user will find it harder to create problems and it&#x27;s just a smaller target because of smaller installed base (and there&#x27;s a little more heterogeneity among the distributions)
Timber-6539超过 1 年前
Flatpaks don&#x27;t necessarily aim to sandbox applications by default. They just give you the platform to DIY in the easiest way possible, esp when coupled with Flatseal. If we really want to criticize Flatpaks for allowing access to &#x2F;home or x11 for compatibility reasons, then we should do the same to traditional applications which are packaged non-sandboxed with the same permissions anyways. And before you say that this is an issue because of unknown contributors to popular Flatpak applications, verified apps from the project owners themselves ship with these same &quot;express&quot; permissions.<p>As far as I am concerned, no general purpose OS will ever come hardened to max defaults; which seems to be the standard applied for security here.
SamuelAdams超过 1 年前
People also assume all defaults are “safe”, and that the out of the box configuration does not need to be reviewed.<p>For example, I just installed Fedora Ashai Linux last night and discovered that the sshd daemon is listening on port 22 by default. Not sure if there was an easy to guess password for that, but it was not mentioned at all in the installer and could have been a big problem if I had not caught it.
评论 #38433835 未加载
butz超过 1 年前
I agree that &quot;Linux&quot; is not secure, but there must be at least a few Linux distributions that are made as secure as they can be.
1vuio0pswjnm7超过 1 年前
The article mentions reducing attack surface several times (in the context of VMs, sandboxing, etc.) but it never considers the ability to reduce the surface of the <i>entire OS</i> (no VMs, sandboxes, etc.). What are other OS that make shrinking the size of the entire OS even easier. Do they exist.
tpoacher超过 1 年前
Placing Flatpak as the top argument on that list to demonstrate insecurity for linux more generally, is a bit like saying your house is insecure if you use a padlock instead of a proper lock, so you shouldn&#x27;t own a house more generally.
rascul超过 1 年前
Might be that none of that really matters. Figure out what security goals you want to meet for your use case and take the necessary steps to get there.
PrimeMcFly超过 1 年前
With the kernels devs attitudes toward security vulns, of course it is.<p>Then again there is stuff like SELinux available which balances things out.
MongoTheMad超过 1 年前
Am I missing something? Isn&#x27;t SELinux supposed to mitigate&#x2F;stop the attacks described?
Thaxll超过 1 年前
&quot;Most programs on Linux are written in memory unsafe languages, such as C or C++&quot;<p>?
评论 #38425292 未加载
评论 #38423154 未加载
评论 #38423179 未加载
betaby超过 1 年前
Meh! From the article &quot;In macOS, all applications require user consent before accessing sensitive data&quot;.&quot; Well and once given have access to all &quot;Files and folders Note: Includes: Desktop, Documents, Downloads, network volumes, and removable volumes&quot;, absolutely in a same way as in Linux. Additionally when installing packets in Linux I would say you give permissions by answering &#x27;yes&#x27; to apt&#x2F;dnf. Such small nuances between MacOS and Linux are not important. Additionally author ignores the fact SELinux may provide protection from accessing random files by random app.
评论 #38423104 未加载
asylteltine超过 1 年前
Mac OS and iOS are beyond a doubt the most secure operating systems. I’m not saying they are bulletproof, but are definitely the most secure compared to anything on the market. Linux desktop is laughably insecure, as much as I love it. Windows? I guess with hardware backed bitlocker(apparently not even the default lmao) is alright.
wly_cdgr超过 1 年前
It is easy for ugly people to be chaste, if you know what I mean
rolph超过 1 年前
so should we all switch to whonix ?
theevilsharpie超过 1 年前
(2022)
kakaz超过 1 年前
Is Microsoft founding FUD campaigns again?
评论 #38423163 未加载
1970-01-01超过 1 年前
Linux being insecure is also a misconception, because its so damn fragmented. Only when a Linux flavor matures does it become a target for hackers.
评论 #38422715 未加载