worst linux distributions

kirashi · November 29, 2016

7 minutes ago, SCHISCHKA said:

well that is an over simplification. I dont know what you mean by UNIX core; they're just adhering to the POSIX standards. MacOS shares code with other projects so its only part BSD

An oversimplification, but the truth if we're going to consider the core security of an OS that doesn't perform package signing by default. To be clear, I'm actually a half Windows half Debian user, so I enjoy my share of Linux administration and know my way around a Terminal Shell quite well.

POSIX Standards were formed in the 1980's after Unix paved the way back in the 1970's at AT&T Bell Laboratories, closely associated with XEROX Palo Alto Research Centre. (Now known as PARC Labs.) Nothing wrong with that actually; it's very good that we have OS standards to properly develop API calls. I also find it a bit ironic that Richard Stallman, the voice of the Free Software Foundation, is also the one behind the GNU License and the Free Software movement, yet OS's following POSIX standards (which was renamed by Stallman) don't follow anything to do with the Free Software Foundation.

Also, I only said macOS is based on BSD; obviously it's vastly different now, and actually ran the mach kernel for a while, which was developed in part by a Microsoft engineer. What I'm saying here is even though OS's are all different, they all share a common core.

SCHISCHKA · November 29, 2016

4 minutes ago, kirashi said:

An oversimplification, but the truth if we're going to consider the core security of an OS that doesn't perform package signing by default. To be clear, I'm actually a half Windows half Debian user, so I enjoy my share of Linux administration and know my way around a Terminal Shell quite well.

i dont think package signing or anything will ever be a default on linux. Who would be the authority that would do the signing?

kirashi · November 29, 2016

19 minutes ago, SCHISCHKA said:

i dont think package signing or anything will ever be a default on linux. Who would be the authority that would do the signing?

You don't even need an authority to do package signing; some devs have started to issue their own PGP-keys. Now, that's not as safe as actually having a signing authority check and sign code, but when you're using a mirror, it's better than not having any form of code signing.

For instance, Spotify on Linux does use the Ubuntu keyserver to authenticate its' installation package, which is a really good way to do things. I don't know if this costs them money or not, but I think more devs should use a similar approach, and either sign things with an official source, or at least using the same site for their packages. https://www.spotify.com/download/linux/

Fetzie · November 29, 2016

1 hour ago, kirashi said:

You don't even need an authority to do package signing; some devs have started to issue their own PGP-keys. Now, that's not as safe as actually having a signing authority check and sign code, but when you're using a mirror, it's better than not having any form of code signing.

For instance, Spotify on Linux does use the Ubuntu keyserver to authenticate its' installation package, which is a really good way to do things. I don't know if this costs them money or not, but I think more devs should use a similar approach, and either sign things with an official source, or at least using the same site for their packages. https://www.spotify.com/download/linux/

I guess the major distributions could set up their own trusted CA for linux applications, and developers could get their key signed by Debian/RedHat et al.