Hacker News Reader

Comment by devit | Hacker News Reader

Well, the biggest advantages of Linux are that the OS vendor is not itself malicious (in particular, does not collect telemetry, push advertisements or attempt to restrict your use of the system like Microsoft and Apple do), the OS is relatively unpopular and thus not a profitable target for malware directed to end-users, and it is flexible and customizable.

You need to use VM-based isolation to have good security with Linux beyond that (i.e. use Qubes or a similar alternative).

View on HN

Yeah, I don't see how windows or mac could ever be considered secure when you can't turn off telemetry and when the systems are closed source and cannot be publicly audited. Linux lets you be as secure as you need to be. The military for example in extreme cases will compile their own hardened version of linux and run it on a custom hardened FPGA soft core. Having that option makes it an actual engineering tool for security vs. a toy imo.

> I don't see how windows or mac could ever be considered secure when you can't turn off telemetry and when the systems are closed source and cannot be publicly audited.

Security != Privacy

Imagine home security monitoring your home 24/7. You lose privacy but gain security.

Sure, but that's besides the point. What if my risk model means not sending packets under specific controlled circumstances because that would reveal my approximate location? What if the right apple or microsoft engineers were coerced into accessing my data? What if the government I am under becomes malicious and forces apple and microsoft to hack my device? Security can give privacy, but a loss of privacy is always a loss of security.

And imagine me monitoring your home. You lose privacy, and I know when you're on holiday and I can rob the place.

It matters who's doing the monitoring. With a home security system, it's you – or whoever you've delegated to –, and you chose to set it up; with these operating systems, it's somebody else, and you have little choice in the matter.

So far Microsoft and Apple haven't robbed anyone, unless you count Apple's RAM and SSD pricing as robbery, which is why many people and companies trust them despite the privacy concerns.

Companies and people who also strongly value their privacy, built and host their own on-prem infrastructure.

> So far Microsoft and Apple haven't robbed anyone

That's not the point. The question is, why should they be able to? And it's not about robbing but having total control over your own hardware.

Because when the moment comes, you can be sure they will do it. Adobe proved it when they disabled the software their customers in Venezuela used, just like that - because they could.

> The question is, why should they be able to? And it's not about robbing but having total control over your own hardware.

Technically nothing is stopping them from robbing you similar how noting is technically stopping your landlord from robbing you and yet most won't do it because they don't like the idea of going to jail.

We enter into an agreement that they won't rob you, and we trust that to the protection you have from the code of law, courts and the state enforcement where you live to protect you from the other party robbing you.

Currently in the EU, I see our governments have enough fangs to ensure tech companies won't rob us but those who seek the utmost independence should roll out their own on-prem.

>Because when the moment comes, you can be sure they will do it.

Then they'll get a class action lawsuit.

>Adobe proved it when they disabled the software their customers in Venezuela used, just like that - because they could.

Yeah, if you live in a country where the state is weak, companies can easily rob you, but if you live in a place without a functioning government like Venezuela, then Adobe is probably at the bottom of the list of entities who are out to rob you, way behind the government itself and various gangs.

> Yeah, if you live in a country where the state is weak, companies can easily rob you, but if you live in a place without a functioning government like Venezuela, then Adobe is probably at the bottom of the list of entities who are out to rob you, way behind the government itself and various gangs.

This is hardly a counter-argument, on the contrary. Imagine being a Venezuelan and already suffering from high inflation rates, social unrest and so on. Now on top of that, you lose access to software you depend on.

Again, the point is not "being robbed". The point is that corporations are in control of important pants of your lives when they shouldn't.

Amazon deleted books from people's kindles though.

And Elon can disable your Tesla if he doesn't like what you're tweeting about it/him.

I think the reason that Linuxes are considered secure is the behaviour that is encouraged amongst its users. With Windows, users are encouraged to install software from random internet sites and there's no central method of updating software (without installing some third party updater from a random internet site).

Also, there's some design decisions made in Windows that lead to poor security. e.g. treating a file's extension differently, assigning it special meaning and then hiding it by default from the user.

I dislike this trope of knocking Windows because of no central method of updating software. Windows software by the very nature has automatic updates, just like Mac, for each application that is installed and well supported (usually). Most applications will check for updates on launch and/or periodically. You could use a third party utility but that just increases the chance of break-age depending on what gets updated. And on a Corporate/Enterprise Environment, all of these points are moot with centralized repositories. The core point is moot in so many ways and shows a lack of understanding of the ecosystem.

The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today. Better that than treating everything as a file and allowing anything to be piped anywhere.

I think the bigger point is the ethos behind the Operating System(s) and the opaque nature of Windows that causes these downstream effects.

> The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today

I don't think that showing a file extension is massively confusing to people if they were always shown them. The problem is that there were real problems with a file extension looking like e.g. a picture, but instead had an executable extension e.g. image.jpg.exe

> The file extension bit is sort of silly as well, as, it's what made Windows as user-friendly and wide spread as it is today.

Are you sure? To me it looks like Windows got popular in spite of glaring security decisions, not because of them.

Windows has had `winget` as a central package manager for a while now. It works great!

I wouldn't be that enthusiastic about it. Best I can say is that it is not terrible. In simplified terms, all it does is download exe files from URL addresses that it gets from yaml metadata files, and then silently executes them; which in turn means that it leaves all of the installer's checkboxes unmodified, cluttering your desktop with icons in the process. On top of that, Windows Terminal has been failing to update on my machine as of late. I don't think this should be the standard for a first-party package manager, but I'd say it's par for the course for Microsoft.

It's also worth noting that all of Winget's code was initially taken from AppGet, without much recognition.[1] Apparently Microsoft cared just enough about that detail to mention the project they forked in passing, as part of a list of third-party package manager projects for Windows.[2] This is why, IMO, you should always first consider a copyleft license for an open source project.

[1] https://www.theverge.com/2020/5/28/21272964/microsoft-winget...

[2] https://devblogs.microsoft.com/commandline/windows-package-m...

EDIT: fixed vertical spacing.

Thanks - this is the first that I'm hearing about it, though I don't use Windows that often.

Do many third parties use it?

Reminds me of the driver update utilities for Windows which notionally did update all your drivers, but also updates all of your viruses.

As opposed to running bash scripts from the Internet.

Well that behaviour is generally discouraged and whenever I do so, I give some due consideration to how much I trust the website. I can also eyeball what the script is doing which is more practical than disassembling some binary although it's common for the script to download a binary. Also, a lot of "install" scripts will set your system up with the software repository, so you use the standard system updates to also keep that software updated.

Great! I don't install driver autoupdaters from random sites either, so either subject is not an issue or your counterargument is invalid.

It's extremely common for Windows users to download and install malware, but very rare for Linux users to do the same, so I don't really understand your point.

You can read those scripts, you know. If you have a passing understanding of bash, it's pretty easy to understand what a script is doing and ensure it's not malicious.

Can you do that with a compiled executable?

You are comparing behavior of people who can read scripts with the behavior of people who consider random 3rd party driver updaters a good idea.

What user can do doesn't matter. It matters what they actually do.

> It matters what they actually do

Yes, and Windows users often install stuff from 3rd party websites whilst it's comparatively rare for Linux users.

> comparatively rare

This would need some substantiation. I personally had not seen many setups that did not require 3rd party websites.

Sorry, I have no numbers for that. However, typical Linux distributions include an incredible amount of software in their repositories, so it's usually only proprietary software that requires installation outside of the OS tools.

No, you are making that assertion. I brought up the driver thing as a joke, but you're the one that turned it into this inane whataboutism

Almost all windows applications are distributed as compiled binaries. Even very advanced users would find it difficult to audit most apps.

Bash scripts are in plain text, and idiomatic enough that it can be read by anyone with a passing familiarity with bash. Which is the very large majority of Linux users. The script very clearly states what it does, and if it doesn't, you shouldn't run it.

Driver updaters are nearly universally malware, and the common advice has always been to avoid them as such. Similarly, running random bash scripts from the internet without even looking is discouraged in the same way. Mystery binaries are much more dangerous than a script because you can't audit them, but the same advice is given for both: don't.

If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin. Windows users install malware at rates order of magnitude higher than any other system. Linux may as well have zero vulnerabilities compared to the shit that Windows users will blindly install.

You're right, it's stupid to compare these situations. So why are you doing it?

> If what the user can do matters less than what they actually do, then Windows is the most insecure operating system by a very large margin.

What does Windows have to do with users ignoring best practice again?

> You're right, it's stupid to compare these situations. So why are you doing it?

I was not, you are excusing yourself from your own mistake. I was comparing people who install driver updaters with people who run random bash scripts from the Internet. Then you tried to convince me the right thing would be comparing with (imho mythical) people who read every bash script they download.

Linux vendors and lots of FOSS apps do collect telemetry, for eg:

https://popcon.debian.org/ https://wiki.debian.org/PrivacyIssues

Advertising is indeed much less common but is being explored. There have been some HN posts about the backlash that occurs when it gets introduced.

Debian popularity-contest is as far as I know opt-in and very innocent compared to most of the telemetry stuff out there. Telemetry by default is evil, but trying to paint Debian as evil is a stretch.

I'm a Debian user and contributor for many years and wrote large parts of the privacy issues page above, based on facts I discovered while using Debian.

Certainly Debian isn't evil, and popcon is indeed opt-in. Popcon does make it possible for all Debian members (who can access the submission data) to probably identify other contributors and possibly others too. Also we do inherit lots of privacy issues from upstream projects. For eg GNOME calculator app in Debian still connects to the IMF and other websites even when.

>Well, the biggest advantages of Linux are that the OS vendor is not itself malicious (in particular, does not collect telemetry, push advertisements or attempt to restrict your use of the system like Microsoft and Apple do)

Except they do: https://www.omgubuntu.co.uk/2022/10/ubuntu-pro-terminal-ad

https://www.eff.org/deeplinks/2012/10/privacy-ubuntu-1210-am...

That's seriously ridiculous. "Ubuntu let users know about automatic updates in the terminal".

It's incomparable to what MSFT does.

Let them know about automatic updates? So you didn’t read either link.

One was advertising Amazon, the other was advertising their paid support service. NEITHER was telling users about automatic updates.

Yes, a tiny, inobtrusive "hey, we offer paid support/automatic updates" after doing a terminal update.

That is easily solved by using Debian instead of Ubuntu.

So then what you meant to say was that _some_ Linux distros are not malicious.

The distributions maybe, but the producers of the Linux kernel are not.

I doubt the kernel maintainers of Windows or MacOS are involved in the advertisements inserted into the GUI of either OS.

The vast, overwhelming majority of them, yes.

Thinking about this. Would firing up various VMs via Boxes be similar to Qubes?

Reply on news.ycombinator.com