Linux

49469 readers

669 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

Linux (In)security - Article arguing that Linux isn't as secure as people claim. Thoughts? (madaidans-insecurities.github.io)

submitted 3 years ago by [email protected] to c/[email protected]

39 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 3 years ago* (last edited 3 years ago) (1 children)

I think a big distinction that must be made would be acknowledging the problem, vs a proposed solution. I think, that is where the internal motivations make more of an impact.

Linux devs can agree that there exists a problem while not agreeing on a solution. Perhaps Madaidan has been more criticized because his possibly bad motivations would influence the solution, not just recognition of the problem? As the above poster said, many other security experts have released similar reports, why is this one turning so many more heads than those?

Perspective of a non-security expert by far. I don't understand everything in the article, but it was relatively well simplified for the common power user I think.

Also, specific question: is his point about sudo insecurity and keylogging mostly mitigated by the better security of Wayland? Is there a better way to secure sudo, or would that significantly reduce usability?

[–] [email protected] 1 points 3 years ago* (last edited 3 years ago)

keylogging mostly mitigated by the better security of Wayland?

Yes and no, programs can't keylog or record the screen of other programs via the wayland interface as they can in X. Wayland (and pipewire) have mechanisms for access control builtin. Thats a good start but it's pretty useless if you don't have proper access control / "sandboxing" for the other parts of your system. I remember reading some PoC code for a wayland keylogger that just injected a library (edit: into user programs) and there are probably some other (more creative) ways to do it.