imschmeg wrote: ↑Thu Apr 16, 2020 12:07 pm
I guess I need to update my associations.
yes, if you want to bow to industry propaganda. check out the page on openbsd for similar schlock:
https://madaidans-insecurities.github.io/openbsd.html
some "security" people are like lawyers, theyre always looking for a way to make their next paycheck essential. im not trying to paint all security researchers this way, but there are opportunists and charlatans in every field.
OpenBSD is also missing many important security features such as CFI, SafeStack, verified boot, TPE and a lot more.
security in the industry is just like the rest of the ibm/microsoft world: its about fancy new features, marketing and one-upmanship in gimmicks. not that the gimmicks are all useless or shouldnt ever be adopted (some are useful) but security in the real world is about
results.
have you heard about the raging plague of malware and security breaches on gnu/linux boxes? when you do, its generally smaller than the media says, the story is frequently tied to
competitor funding, and the real story is very often not about gnu/linux but about a piece of software that also runs on windows.
the rest of the time its about people who didnt run updates on production servers or who misconfigured things. but by all means, fear the inadequacy of your gnu/linux server. theyre dropping like flies you know, gnu/linux is just a giant botnet at this point. oh, and bsd too, apparently.
one of the most important things youll ever learn about security, is that when you get away from reality and research, youll find a large supply of people selling fly hammers (for hitting flies) and orbital laser hand grenades. sandboxes also break, but they sell them like youve got swiss cheese and sandboxes fix everything. just like the security youve already got, the new shiny also breaks when you misconfigure and dont run updates. security theatre is higher profit than reasonable security. trusted boot secures profits, thats for certain.
https://en.wikipedia.org/wiki/Trusted_P ... #Criticism
as to whether this post is on topic, i like to think it is. im all for a more secure distro, but more importantly i care about user freedom. its up to the user to turn on (or leave on) security features, based on their threat model. some people feel the need to have sandboxing or hardware and firmware-based security.
others have different needs. a distro that tries to turn everything on at once is already assuming a lot, but if you can turn things off, thats fine.
distrowatch still considers "trusted end node security" an active distro, but lists the most recent update as 2014. sandbox all you want, youll still have vulnerabilities that need patching-- the same as now.
and 
).
