Item — HN Reader

ChromeOS seems very interesting to me because it has managed to achieve a degree of security that no other desktop OS (Windows, macOS, and of course other desktop Linux, which are the least secure of the bunch) can even approach. It has been designed from the ground up to be secure: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sec...

- Verified boot backed by TPM.

- System services are heavily sandboxed: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/san...

- New userspace is written in Rust: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/dev...

- Web pages loaded on Chrome have no access to the device's filesystem, nor to user files.

- Android apps run inside a restricted container.

- Linux apps run inside a VM, which leverages KVM and a custom Rust VM monitor.

I think it'd be great if someone made a de-Googled fork of ChromeOS without all the Google telemetry and bloatware, because it'd be the perfect Linux distro for security-conscious individuals.

9 comments

A rock is also pretty hard to hack.

The hard problem of security is giving the user the power of a general-purpose machine without exposing them to the risks. "Don't run your favorite software lol" is not a valid approach to security. ChromeOS remains totally unsuitable for even casual usage, let alone anything serious.

Someone will, I'm sure, claim that the use of virtual machines is a solution. It isn't. The layers of virtualization in ChromeOS lead to atrocious performance, reliability, and functionality. I am not willing to tolerate half my programs living in a different universe from the other half, nor am I willing to tolerate uptime measured in hours.

I'm not sure what you mean by uptime measured in hours, it seemed fine to me in the years where I used it.. It also provides all of the common computing including all of the browser debuggers, etc, the state of common computing might not be that impressive but that is Windows, OSX and Linux' fault.

One could argue that anything you can't do on a ChromeOS machine (or an equivalent Firefox one if that project were more complete) without running a VM is proprietary garbage. The other Apps you will run will work on some percentage of machines, the device you use have incomplete drivers, the window environments they developed for were not worth standardizing such that a browser has to provide the standards layer.

Secure, performant, execute any code - choose 2. You have to choose an edge on this triangle.

Is security an actual practical concern for desktop users savvy enough to know what a container is?

The only people I know who've had any sort of malware infection at all in the last 15 years are the ones who download and install random .exe files from spam emails and pirated TV streaming sites.

Sadly ChromiumOS still requires Google. ChromeOS to me feels like an attempt to make laptops more like smartphones. The security is there to protect what's running on your machine from you than you from bad actors.

I feel a bit similarly. I'm torn these having very cool and interesting security properties but this way of using computers, for a lack of a better description, is just not what I'm after.

The system design is unique and interesting. It's a shame that the user experience doesn't align with how I want to use my computer, so I'll keep using desktop Linux and implement a bit of sandboxing myself. For the average consumer it could probably replace Windows for a lot of use cases and improve security due to its strict locked down and hard to exploit nature.

How, pray tell, are you getting to "Desktop Linux, the least secure of the bunch?"

https://madaidans-insecurities.github.io/linux.html

https://privsec.dev/posts/linux/linux-insecurities/

https://bjornpagen.com/en_US/desktop%20linux%20is%20insecure

Maybe someone with more knowledge than me can explain - flatpaks seem way more secure than anything you would ever install in Windows by a long shot. It's also fairly trivial for me (and I'm by no means a hardcore user) to use a completely immutable version of linux such as Silverblue. The other complaints in these links also seem suspect. If the Linux kernel is insecure due to it being monolithic doesn't that make ChromeOS just as insecure? What about android? What about the "96.3% of the top one million web servers [that] are running Linux"?

Also there's something to be said for security through obscurity. My bet is I could go through my entire junk mail folder opening all attachments on Linux without a problem, but it'd take me less than 10 on windows to be fully owned. If you're careful on Linux aren't you far, far safer than if you're careful on Windows?

The first article links to this [1]:

Almost all popular applications on flathub come with filesystem=host, filesystem=home or device=all permissions, that is, write permissions to the user home directory (and more), this effectively means that all it takes to "escape the sandbox" is echo download_and_execute_evil >> ~/.bashrc. That's it.

This includes Gimp, VSCode, PyCharm, Octave, Inkscape, Steam, Audacity, VLC, ...

To make matters worse, the users are misled to believe the apps run sandboxed. For all these apps flatpak shows a reassuring "sandbox" icon when installing the app (things do not get much better even when installing in the command line - you need to know flatpak internals to understand the warnings).

[1] https://flatkill.org

I guess I just don't buy it completely. Given that I myself have had a hard time giving permission to Flatpak to access even an unimportant network drive (Flatseal is a godsend for giving/denying permissions in any way you please) while the same app on windows will happily write anything to C:\Windows\System32 , I feel like we're talking about entirely different beasts. But perhaps I'm naive. I also feel like there would be a very large vested interest in making people feel more unsafe in linux than they do in Windows/MacOS for obvious reasons.

And given that the version of Fedora I use is immutable and even I have a hard time messing with it to the point of pain/exploit with full access to the system (and I've tried for fun in VMs) I feel like a trusted flatpak app I download from a trusted source is going to have a damn near impossible time doing much of anything. While I feel like a simple website hack that serves me a bad .exe could/would cripple every single file it can find on my network on a Windows machine.

You're right. I'm entirely unconvinced by anyone in this thread on that Linux isn't still WAY safer all around.

You can come up with theoretical threats all day that Linux is susceptible to, sure.

But at the end of the day, there is not a single serious cloud company (or just about any tech company that isn't MS) genuinely looking at "we should switch to Windows or MacOS for the backbone of our company," And it's Linux that gets the downstream security that comes with that.

Whole lotta cope in this thread.

Flatpak permissions are very broad by default in most applications. Even if you manually override them by using Flatseal, some permissions like X.org or PulseAudio sockets are very problematic because these legacy protocols are not designed to be secure. Even if you manage to lock down permissions and only use modern apps that support Wayland and Pipewire, the Flatpak sandbox still exposes a lot of kernel attack surface because it blocks very few syscalls. I think they should add something similar to Win32k lockdown (ProcessSystemCallDisablePolicy) on Windows and disable insecure components like io_uring.

As for immutable distros, AFAIK Silverblue and others are immutable in the sense of package management, but there is actually no process to ensure the integrity of the full boot chain because initrd can be trivially modified by the host and is unsigned. There is a UKI (Unified Kernel Image) proposal that will likely be the path going forward (at least on the Red Hat world), but I think it's still years away.

In my opinion, if you want to use Linux desktop securely, just use Qubes.

I fully agree with using Qubes, but I also think for most people in most cases that's akin to putting a bank vault door on the front of your house. I guess the question I would ask is: gun to your head you have a choice between running a random Setup.exe in Windows, a .sh/.deb/.rpm in linux, or a Flatpak. Which one are you choosing? 10/10 times I'm choosing the Flatpak myself. It might not be perfect, but it does seem better than most alternatives everyone uses all day every day.

> for most people in most cases that's akin to putting a bank vault door on the front of your house

If we are talking about a device in which you do banking, shopping, manage sensitive or work data, etc. then I think security should be a priority. For more casual use, I agree Qubes would be overkill.

> Which one are you choosing?

I'd rather execute Setup.exe inside Windows Sandbox or denying UAC prompts, or a random macOS binary (provided SIP is not disabled) than a Flatpak. To be clear, I think Flatpak is an improvement, I'm glad it exists and I hope it continues evolving. But in my opinion, the Linux desktop still has a long way to catch up to Windows and macOS on security.

This tells me imperfect, which, sure. It doesn't tell me "the worst of the bunch."

Compared to the other desktop operating systems (Windows and macOS), it absolutely is. It might have other advantages, but security is not one of them, and users should be aware.

huh? Linux security is is soo annoying it won't let other apps spy on key strokes so no way to have push to talk or have OBS on a keybinding.... mean while on windows all apps are key loggers

This the first I'm hearing of this, you should respond more substantially than repeating the assertion that's specifically being questioned.

In my previous reply, I linked three articles which discuss the technical details extensively:

https://madaidans-insecurities.github.io/linux.html

https://privsec.dev/posts/linux/linux-insecurities/

https://bjornpagen.com/en_US/desktop%20linux%20is%20insecure

A brief summary: No trusted boot, no clear security boundaries between system and applications, no application sandboxing, lack of mitigations (both on kernel and userspace), large kernel attack surface, insecure-by-design legacy systems (X, PulseAudio). Windows and macOS perform comparatively better on all of those.

Again, you're talking about a ton of mostly theoretical problems that haven't caused much in the way of widespread problems, which to me don't come close to the following fact:

No serious cloud, perhaps tech generally, company, is like "We're switching to Windows/MacOS to run the backbone tech of what we do."

That's Linux, and Linux will get the downstream security benefits of that. Given actual, real life history, I trust this far more than those other two, especially Windows, which just shat the bed ALL THE TIME. Your real life track record is far more reliable that a parade of imaginary horribles, even when they may be little things that only are on the Desktop.

>I think it'd be great if someone made a de-Googled fork of ChromeOS without all the Google telemetry and bloatware, because it'd be the perfect Linux distro for security-conscious individuals.

Since such a thing is currently unavailable, I'm inclined to try running ChromeOS, then having a headless Linux box next to it in the hopes that my customizing the headless Linux box will satisfy my need to customize my software environment.

For example, I'm inclined to try to keep most of my personal files on the headless Linux box.

The article mentions Chrome OS Flex, which is a version that doesn't require the Google security chip so it runs on a regular Intel PC. That is "de-Googled" I suppose, though I am not sure about the security implications that you mention.

De-googled as in not tied to a Google account and its web services. Look at something like ungoogled-chromium.

Has been bought out by Google though and it's now part of their enterprise products to install ChromeOS on non-Chromebooks.

You lose secure boot when using ChromeOS flex. It's also not "degoogled".

FYI Android apps are also in a VM now.

https://chromeos.dev/en/posts/making-android-more-secure-wit...

Yeah, ChromeOS is actually pretty good for nearly everyone. Perhaps most importantly, they're incredibly popular in schools right now and have been for a few years. Google has definitely been working towards a long play with shifting the younger generations mindshare towards ChromeOS and away from Windows for productivity. It's interesting because it does actually have some of the necessary holes punched through to allow for serious power/dev usage, but is also secure by default and as usable as the websites you go to.

> ChromeOS is actually pretty good for nearly everyone.

It's been a while since I've given it a try, but I dislike ChomeOS for the same reason that I dislike MacOS. They make me feel like I'm wearing a straightjacket and get in my way.

And, of course, any OS that requires me to have an account on any other server is not fit for purpose (to me).

And you're absolutely right about that - But it's a great OS for devices that you don't own. Leaving aside the (frequent, ugly, and probably illegal) times that school districts require parents to purchase children chromeOS devices that get joined to the school's domain, it's a very common problem to want to have devices that are locked down according to organization policy. When you are giving a device you own to someone else to physically control, the ChromeOS Straight Jacket is a great tool.

There's a distinct problem with it being the only tool around, though.

ChromeOS is actually "pretty good" for someone who only looks at websites like facebook and reads email. It's also extremely confining and spies on you which makes it unacceptable for a lot of people and it's a sin that students are often stuck with them.

US Schools, they are almost unseen in the rest of the world.