Item — HN Reader

There won't be one. I've said it all.

I was thinking about adding a "Security" section but I wasn't convinced it was necessary. Security in Linux is horrible in general.

* People use `sudo` for anything and everything all the time. * `git pull whatever_crap_from_the_web` and run it happily. * Tens of thousands of pieces of malware via NPMs and other frameworks. * No AV of any kind (the one that actually executes code in a sandbox and verifies its safe). * Permissions/users/groups/pam.d/logind/selinux/apparmor - it's a huge intricate mess.

1 comments

Verifying arbitrary code is safe is not possible for AV to do. If you know some way to do what you describe, you can commercialize it and become rich. Many would pay top dollar for such technology.

Virtualization and sandbox environment code execution have been available for years now in multiple Windows AVs. And it works great.

Linux on the other hand has absolutely nothing and it's still "OK".

"Windows is not perfect and thus Linux is OK". I've heard that way too many times. Sorry, doesn't work for me.

That is a waste of resources that cannot prove the safety of arbitrary code. If you want safe code, use code only from trusted sources.

Windows gives a semblance of trusted code, also Microsoft sells certificates to developers.

Nothing (!) like that exists in the Linux world aside from PGP cross singing which barely any projects use because of its sheer complexity.

Don't lie about Windows and don't lie about Linux.

And Windows 10/11 both mandate that installers are signed before you can even launch them, so there's a very decent first line of defense which is TOTALLY missing in Linux.

Also, "trusted sources"? Who and why would you trust? Seasoned engineers in my company git pull any crap from the web and run it happily without thinking twice because AGILE and things like RoR. Who do you trust among thousands of modules?

God damn it.

Linux fans will make up all sorts of crappy pseudo-arguments to portray it as a decent/secure/stable OS and it's none of that.

On servers where you don't touch anything and never install third-party software? Yeah, surely. No one cares.

Distribution package maintainers generally vet the packages they make avaliable and updates to repositories are typically PGP signed with cryptographically secure hashes for the files. I say typically because I am only familiar with Gentoo and to a lesser extent, the Debian family.

As for Windows, there is no signing requirement according to Microsoft:

  > Windows doesn't require software developers to digitally sign their code

https://learn.microsoft.com/en-us/windows/security/applicati...

You are the one making stuff up.

Try to run an unsigned installer in Windows 10/11 and tell me how it worked for you.

This is how it works and looks:

https://docs.anythingllm.com/installation-desktop/windows

https://github.com/gitextensions/gitextensions/issues/7738

I never said it was a requirement.

What's more you can enable GPO policies to prevent the user from running any new/unknown apps.

https://learn.microsoft.com/en-us/windows-server/identity/so...

Good luck implementing that in Linux.

Continue to use a crap pseudo-OS with no security and believe everyone around is a geek who is willing to learn CLI, bash, vi, git bisect, reading mans, etc. just to use it.

You have now accused me of saying something I'd never said, you crossed the line and goodbye.

You said:

  > Windows 10/11 both mandate that installers are signed before you can even launch them

The word mandate means that it is a requirement.