Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There's a very simple solution to this: Don't run apps that you don't trust.

If you simply must, use a VM or AppArmor or SELinux. Don't inconvenience everybody because you're too lazy to be responsible for your own data.

Besides, untrustworthy apps will bypass the protections anyway. Judging by the popularity of "curl <url> | sudo bash" lately, they'll probably just ask for root directly.



I have some degree of distrust of most of my applications. The "open trust" model usually ends up getting abused to the point where we have to lock it down...like early Windows, wide open for easy of administration, leading to things like the notorious "Blaster" worm, or the open architecture of the Internet, where we now have massive spam and DNS amplification attacks and all sorts of problems based on the notion of a trustworthy network.

In general, everything in computing will keep going in the direction of "trust everything as little as possible for it to do its job" forever, I think, and probably has to.


>a few users are too lazy

Running untrusted programs is the default way we do computing. No one has time to audit every single program they run. The current desktop security model comes from when people mostly ran the programs that came with the OS and programs they wrote themself. Its vastly inappropriate for modern computer usage.


> The current desktop security model comes from when people mostly ran the programs that came with the OS and programs they wrote themself.

Even that isn't particularly safe.


It was good enough to stop bob on floor 5 from hogging all the CPU and preventing Jim's buggy script from deleting everyone's emails.


"Don't run apps that you don't trust"

So basically no apps at all.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: