Most active commenters

    ←back to thread

    Malicious versions of Nx and some supporting plugins were published

    (github.com)
    441 points longcat | 13 comments | 27 Aug 25 01:38 UTC | HN request time: 0.448s | source | bottom
    Show context
    vorgol ◴[27 Aug 25 13:00 UTC] No.45039050[source]▶
    OSs need to stop letting applications have a free reign of all the files on the file system by default. Some apps come with apparmor/selinux profiles and firejail is also a solution. But the UX needs to change.
    replies(5): >>45039375 #>>45040698 #>>45041459 #>>45041809 #>>45045968 #
    1. terminalbraid ◴[27 Aug 25 13:26 UTC] No.45039375[source]▶
    Which operating system lets an application have "free reign of all the files on the file system by default"? Neither Linux, nor any BSD, nor MacOS, nor Windows does. For any of those I'd have to do something deliberately unsafe such as running it as a privileged account (which is not the "default").
    replies(6): >>45039776 #>>45039798 #>>45039824 #>>45040322 #>>45040368 #>>45040974 #
    2. sneak ◴[27 Aug 25 13:57 UTC] No.45039776[source]▶
    https://www.xkcd.com/1200/

    All except macOS let anything running as your uid read and write all of your user’s files.

    This is how ransomware works.

    replies(1): >>45040144 #
    3. ◴[27 Aug 25 13:58 UTC] No.45039798[source]▶
    4. eightys3v3n ◴[27 Aug 25 13:59 UTC] No.45039824[source]▶
    I would argue the distinction between my own user and root is not meaningful when they say "all files by default". As my own user, it can still access everything I can on a daily basis which is likely everything of importance. Sure it can't replace the sudo binary or something like that, but it doesn't matter because it's already too late. Why when I download and run Firefox can it access every file my user can access, by default. Why couldn't it work a little closer to Android with an option for the user to open up more access. I think this is what they were getting at.
    replies(3): >>45040122 #>>45040191 #>>45045248 #
    5. doubled112 ◴[27 Aug 25 14:21 UTC] No.45040122[source]▶
    Flatpak allows you to limit and sandbox applications, including files inside your home directory.

    It's much like an Android application, except it can feel a little kludgy because not every application seems to realize it's sandboxed. If you click save, silent failure because it didn't have write access there isn't very user friendly.

    6. fsflover ◴[27 Aug 25 14:23 UTC] No.45040144[source]▶
    You forgot the actually secure option: https://qubes-os.org
    7. skydhash ◴[27 Aug 25 14:26 UTC] No.45040191[source]▶
    Because it will become unpractical. It’s like saying your SO shouldn’t have access to your bedroom, or the maid should only have access to a single room. Instead what you do is having trusted people and put everything important in a safe.

    In my case, I either use apt (pipx for yt-dlp), or use a VM.

    replies(1): >>45045319 #
    8. spankalee ◴[27 Aug 25 14:36 UTC] No.45040322[source]▶
    The multi-user security paradigm of Unix just isn't enough anymore in today's single-user, running untrusted apps world.
    9. SoftTalker ◴[27 Aug 25 14:39 UTC] No.45040368[source]▶
    How many software installation instructions require "sudo"? It seems to me that it's many more than should be necessary. And then the installer can do anything.

    As an administrator, I'm constantly being asked by developers for sudo permission so they can "install dependencies" and my first answer is "install it in your home directory" sure it's a bit more complexity to set up your PATH and LD_LIBRARY_PATH but you're earning a six-figure salary, figure it out.

    replies(1): >>45043050 #
    10. pepa65 ◴[27 Aug 25 15:23 UTC] No.45040974[source]▶
    Even just having access to all the files that the user has access to is really too much.
    11. ezfe ◴[27 Aug 25 18:15 UTC] No.45043050[source]▶
    Even with sudo, macOS blocks access to some User-accessible locations:

    % sudo ls ~/Pictures/Photos\ Library.photoslibrary

    Password:

    ls: /Users/n1503463/Pictures/Photos Library.photoslibrary: Operation not permitted

    12. terminalbraid ◴[27 Aug 25 21:03 UTC] No.45045248[source]▶
    I'm not saying user files aren't important. What I am saying is the original poster was being hyperbolic and, while you say it's not important for your case, it is a meaningful distinction. In fact, that's why those operating systems do not allow that.
    13. eightys3v3n ◴[27 Aug 25 21:10 UTC] No.45045319{3}[source]▶
    I don't agree that the only options are "give it almost everything" or "give it nothing and now it's a huge pain in the arse". Which seems to be what you implied. I do think there are better middle grounds where an app almost always works out of the box but also can't access almost everything on the system. There are also UI changes that can help deal with this like the Android security prompts do.