Hacker News Reader

Comment by kelnos | Hacker News Reader

I think you have a definition of "easily" that many might not subscribe to.

If this policy isn't available and enabled by default in some package containing common policies, do you really expect your average developer to a) even know anything about AppArmor, or b) know how to write an AppArmor policy file without spending a few hours digging through docs, reading examples, and engaging in a bunch of trial and error?

(If your answer is "yes" to either of those questions, I'd suggest you might overestimate what is common knowledge.)

View on HN

Fair enough. I meant easy as in without installing any additional software, minimal config and ease of use.

AppArmor has come a long way. It's worth learning about it. They have quite a few builtin profiles that you can take advantage of.

Only on HN can you use the word "easy" to describe a set of steps that follow directly after, and still end up having to clarify the word easy referred to your steps, not to the entire concept of the underlying technology.

People mean the steps are not easy. Because it's now about copying them but being able to create them yourself on the fly for whatever you need.

I really don't get what this is trying to say.

Like, the tone of the comment makes no sense, the hard part isn't on the OP, and OP wasn't saying AppArmor is easy, just the content of their comment is easy (which it is!)

It's like saying flipping a light switch to turn on a light is easy... the having someone fly in complaining that understanding industrial power generation is not easy at all.

it's easy, just do 'rm rf /'

My point is: how do we know the instructions are actually safe?

Oh brother. It's like wrestling a pig in the mud.

If you don't trust it, don't run it... but I don't know how anyone in software development would be unable to function if they've never been able to trust someone else's config file suggestion.

> content of their comment is easy (which it is!)

It's not, it has subtle gaps in the sandbox which still allow some of the attacks it's supposedly protecting you from.

We reached a state where code monkeys believe they are developers. Of course you should know about the machine you are developing on.

Nah. I agree with the other guy. AppArmour takes some time to learn and isn't super mainstream yet. At least it's a step forward from SELinux, but it still feels uncooked and adhoc to me.

There's an insane amount of tooling with varying degrees of overlap. You've got SELinux, BPF, seccomp, AppArmor as different approaches to security. Each of these takes quite a bit of dedicated time to master and most of them have lots of nuance & there can be overlap depending on what you're trying to secure. In a work environment, I'd typically outsource this to security engineers/experts OR spend my time learning those things for what I need them for - knowing the tools are out there are sufficient starting points for research when I need that knowledge.

None of this applies to maintaining my development machine. You might want to revisit your gate keeping.

Im not a developer, but in the field I work in, a couple hours dedicated to learning a tool that would help you isnt much of an ask.

And the little demo script GP wrote seems pretty straight forward to me.

What other tasks are planned in your current sprint?

Then you are not a devolper but an assembly line worker.

Reply on news.ycombinator.com