Hacker News Reader

Comment by sprash | Hacker News Reader

People rarely run untrusted software on FOSS systems. If you can't trust your package manager and your distrobution you have all kinds of problems the least of which is sandboxing applications.

The only untrusted programs I run are Steam games and FPGA tools, and for those I created a separate user account.

The notion that every application must be 100% sandboxed is mostly security theater and will make your life with daily work in the real non-theater world a living nightmare.

View on HN

If you define untrusted software as anything not coming from your distro's official package manager, many people run lots of untrusted software on their Linux systems. Think of PPAs (Debian/Ubuntu/etc), the AUR (Arch/Manjaro), and many other package managers (pip, conda, npm, cargo, etc.).

You have always the option to put programs that you don't trust into a jail. It just shouldn't be mandatory.

Besides, the only good way to solve that problem is namespaces as they are used in Plan9. Sadly Unix/Linux took the wrong turn at some point (probably with the introduction of sockets).

Lookin at you rpmfusion...

> The only untrusted programs I run are Steam games and FPGA tools, and for those I created a separate user account.

Do you also run a separate display server? I'm not convinced a truly malicious executable can be stopped by boundaries between users.

Yes, I run those programs in a separate Xorg session. If I need it on the same session I simply spin up a Xephyr window.

Sounds like a hassle. You might as well run it on a separate computer, at least you will be able to use them at the same time. I would prefer better app isolation so I can run everything with the same user, but still hold the apps accountable for what they are doing. OS’s have been designed when the computing paradigm was “computer as large as a building shared by 20 people that write their own software”. That paradigm has changed and the application landscape makes it that we have to use apps from people we don’t know and we can’t reach. We have to make their apps accountable.

It is not a hassle because it is rare to run untrusted software on FOSS systems. Also spinning up a Xephyr window is trivial and not at all like "running it on a separate computer". Setting permissions for each and every installed application in a whitelist model you are proposing would be much more of a hassle. It is already a nightmare on Android where you wave away all kinds of access rights at the point of installing and you just don't care anymore because it becomes really annoying.

The solution to better security is not sandboxing. It is running only trusted application in the first place and making the implementation of those applications simple enough so that many people can understand the source code.

Many people just paste command lines they find on the internet which start with

    curl ... | bash

And what do you want to do about it? Do you want to sandbox Bash? That would make Bash completely useless.

> People rarely run untrusted software on FOSS systems.

Reply on news.ycombinator.com