Linux may not be totally secure but it is securest of all the viable options.
It goes on and on. You should read the OP; it is really quite informative.
One thing that bothered me about this story for a long time was the fact that Google is pretty good at security, but Google allows its employees to use Linux on end-user devices. Then I realized that Google cannot trust its employees: with 40,000 software developers, Google must operate so as to be secure even if a few of those developers secretly hate Google and want it to fail or have been paid off or blackmailed into harming Google. The measures Google takes to protect against such employees (i.e., making sure that all code is reviewed by another developer before deployment, and making it so that a reviewer cannot choose which coders he reviews and vice-versa) naturally also protect against Linux running on the devices in front of the employees. (Even then Google is unsatisfied with the security of any of the publicly-available distros with the result that Google maintains its own internal Linux distro.)
I'm going to let this pass since I don't want to start a flamewar here but I think it's very rude to imply I didn't read the OP, and I think less of you for it.
So to summarize, you believe ChromeOS is immune to the Kernel's security vulnerabilities outlined in the OP because:
- it uses sandboxing (unrelated to kernel security) - disabled io_uring - it uses SELinux (unrelated to kernel security) which other distros do as well but you believe ChromeOS does it more effectively for desktop applications
I remain unconvinced.
So in the worst case where an attacker gains code execution in the kernel, you just reboot the device and are guaranteed to be safe again.
But this is a perfect example of how the premise itself is fundemntally clickbait. The problem of insecurity is unrelated to Linux, but the execution and privilege model of userspace.
If you put an assa abloy on your door, and then elect not to lock it. That doesn't mean assa abloy is the least secure lock.
Windows has a reputation for being insecure because if you try to keep someone out, they can still get in. This article was written on the idea that Linux is insecure, because when you don't try to keep someone out, they can get in.
Android, ChromeOS and Qubes are secure by default. Though I wouldn't trust a novice user with QubesOS.
Honestly I'm not sure how you can consider any of that secure.
this, just like many other points is not security, sorry.
Security is about (among other) CVEs, not ads.
>reboot autonomously, destroying your open work,
bullshit
>upload all your files to one drive without consent
without consent? did onedrive magically figure out your MS credentials?
>steal your email password
what?
>>reboot autonomously, destroying your open work,
>bullshit
Honestly baffled how you can deny this. Windows rebooting on its own is one of the most defining features.
>this, just like many other points is not security, sorry.
Bullshit.
There's only scenario where I can imagine Windows rebooting ""on its own""
You've scheduled an update or you're delaying update for long peroid of time?
>>this, just like many other points is not security, sorry. >Bullshit.
How so? in the principle ads aren't security issues (unless badly implemented)
>Check the recent headlines. Windows is pushing user files to one drive and stealing email passwords to proxy your email account on Microsoft servers.
I've literally googled: "windows stealing email passwords"
and the very first thing is article from 2016 and the other are about Malware/Scam, so how what article are you talking about?
Probably referring to this https://news.ycombinator.com/item?id=38212453
You have this very backwards, CVEs are about Security and not the other way around.
Consider why we care about security in the first place:
- We don't want our private data stolen
- We don't want a malicious program stealing our electricity and computing resources
- We don't want adware injecting advertising into our browser toolbar, homepage, email client, etc
- We want our family to be able to safely use our computers without having to worry about them falling for scams
- We want peace of mind
Unconsented advertising is absolutely a violation of security in the same way a salesmen breaking into your house to sell you things is. Don't miss the forest for the trees here.
Do not forget that the CVE system is fundamentally just a tool for tracking computer security vulnerabilities, a tool that unfortunately incentivises pedantic security researchers to fill it with garbage to pad their resumes, a tool who's authority is worshiped like a god by corporate IT departments despite it's inadequacies, but a tool nonetheless which just happens to be better than it's alternatives.
The fact that deliberate security violations enforced by the vendor are not tracked by the CVE system, is not evidence of Security, but simply a limitation of the system.
>- We don't want our private data stolen
>- We don't want a malicious program stealing our electricity and computing resources
>- We don't want adware injecting advertising into our browser toolbar, homepage, email client, etc
>- We want our family to be able to safely use our computers without having to worry about them falling for scams
>- We want peace of mind
Almost all those points are basically the same thing repeated differently:
We don't want somebody else mess with our computer, but that "somebody else" almost always is 3rd party - so not you (user) and not Microsoft (vendor).
Ads from vendor aren't considered as a security issue (unless very edge cases).
They are annoying, but in the principle they aren't security defect (unless badly implemented)