Hacker News Reader

Comment by eecc | Hacker News Reader

I’m starting to distrust the current security model of all major operating systems. Assuming a safe CPU - and that’s a big one already - I’d like a system where any random app does not have unfettered access to any user file, where individual files can be classified and restricted from being accessed by processes with network capabilities and so on. Android permissions are a start.

This and browsers should really just execute in their own externally managed sandbox

View on HN

You can already do something like this with Flatpak on Linux https://en.wikipedia.org/wiki/Flatpak or VMWare Thinapp for Windows https://en.wikipedia.org/wiki/VMware_ThinApp.

Want to try it now? You can try it with Steam, which is otherwise notoriously annoying to install on Linux:

  flatpak install --user --from https://flathub.org/repo/appstream/com.valvesoftware.Steam.flatpakref
  flatpak override com.valvesoftware.Steam --filesystem=$HOME

  # run it with this command:
  flatpak run com.valvesoftware.Steam

Unfortunately, if you're running X11, Steam can still spy on everything you're doing in X11. But Wayland is coming/is here, and fixes that too.

Unfortunately, if you're running Wayland, many games turn into an audio game, lacking video (stellaris on F27, I’m looking at you).

:sigh: year of the linux desktop, ...

You should take a look at QubesOS : https://www.qubes-os.org. Each application starts in a VM in order to isolate them from each other.

The only issue is that QubesOS rely on paravirtualization (it's a Xen hypervisor underneath) for process isolation.

(By the way Windows is taking the same path with ApplicationGuard)

It also runs your network connection and firewall in their own VMs, plus makes it easy to stack more. e.g. you want to connect to a VPN and then to Tor? No problem.

At the same time you can run your password manager in a VM with no network access.

I think Qubes' approach should be the default. There is no valid reason for so many permissions by default. The current default for example on Debian is crazy! Any user can read the home directory of any other user by default! If somebody whould have told me that before knowing it, I would have considered it a bad joke. I can't fathom why it's not changed.

However, Qubes can't protect against malicious hardware. I see no way around it, we must have hardware with completely open sources.

Mandatory access controls were invented to address this exact weakness. Ironically, selinux might be the most mature implementation of it in Linux, if not the rest of the Unix land.

Reply on news.ycombinator.com