Hacker News Reader

Comment by awinter-py | Hacker News Reader

Is the author saying we need mobile-style app permissions on the linux desktop? (I know there's apparmor but I don't understand it). That would be awesome.

Throw phone-home & disk access restrictions into the mix and I'm even happier.

I know there are sandboxing tools for linux desktop -- the community needs to identify one that's easy to use and start using it. Let's recruit closed-source OS users to linux by dangling easy-to-use privacy.

View on HN

Did you read the article? He particularly calls out applications which use HTTP and/or are vulnerable to MITM attacks. They're not really "sexy" bugs to fix and many older open source projects are languishing, since it's much more fun to create new software than maintain old software written by someone else.

Sandboxing doesn't fix apps not validating SSL certificates?

correct, but it limits the data they can exfiltrate. I can live more easily with my weather app downloading its upgrade patch over HTTP if there's a sandbox limiting what that hostile update will do when it lands.

The Linux kernel has had a lot of holes in the namespace stuff used for containers, I doubt that there will not be more. Not to mention all the local root exploits, seLinux-bypass, information leaks and so on. If you're relying on Linux features for security without at least using the grsec patches, you probably already lost.

Reply on news.ycombinator.com