Hacker News Reader

Comment by revelation | Hacker News Reader

The Linux desktop of today still occasionally requires teaching users how to install new udev rules so they can properly use that USB serial converter or other gadget sanely.

Now imagine raising that pain to the power of 10, but instead of only weird USB or "device not found" errors nothing works anymore because "AppArmor" is blocking syscalls. I can already see the StackOverflow answer that just tells you to set it to permissive, and you know what, that fixes it everytime, too!

This is just a non-starter. Maybe they should look at deploying ASLR first, it's not 2000 anymore you know. (Update: they just managed to get this done with stretch, released 4 months ago! That's only like 7 years late for a crucial actual security feature)

View on HN

Since the Year of Linux on the Desktop has still not come, perhaps major distributions would be wise not to use that as a reason not to implement security features.

Last I checked, the Year of Linux on the Server has been every year for many, many years. And it's the servers and their vulnerabilities which are exposing tens of millions users information at a time, not individual Linux desktop users.

Last I checked everyone running Linux on the Server has skipped ahead to containers so now very little of these syscall filtering games even apply anymore.

Too late for servers, too early for desktops. That always felt like a succinct summary of SELinux.

> Last I checked everyone running Linux on the Server has skipped ahead to containers so now very little of these syscall filtering games even apply anymore.

That's a big jump. Any stats on the so called container usage by "everyone"? Even here in the HN-bubble everyone isn't running containers

Huh, didn't know that Debian was missing ASLR. Any idea about the reasoning there?

What makes you think debian is missing ASLR?

> Update: they just managed to get this done with stretch, released 4 months ago! That's only like 7 years late for a crucial actual security feature)

Dunno, taking @revelation's word for it? Mentioned they were missing it. It sounds funny to me though. I'm not a Debian user.

edit: The Debian page on security features confuses me (https://wiki.debian.org/Security/Features).

Funny thing is that udev is in the hands of the systemd devs, operating under the Freedesktop banner, so one would have thought they had the desktop in focus.

But i guess pampering devops is so much more lucrative in the kudos department...

Reply on news.ycombinator.com