I lost braincells reading this. The entire point of open source software is to have it visible and auditable, aka the exact opposite of security through obscurity.
If you want to bash OS’s for relying on STO, go after iOS and Windows. Those OS’s, being closed source, are the ones relying on it
I don’t know where you got the notion from that Linux as a whole uses this concept, but it’s nonsense. There’s exactly one place where this definition fits, which is the GRUB bootloader encryption (which merely shifts the target for the Evil Maid attack from the initramfs to GRUB). But this is already adressed with Verified Boot.
Nothing else, let it be LUKS, PAM, SELinux, AppArmor or whatever has any business with STO.
You confused “obscurity” as in a synonym for low popularity with the word “obscurity” as in people not knowing how it works and people deliberately hiding the inner workings of a system.
Everyone using Linux can know how it works, that’s the opposite of obscurity in the sense it is used within “security by obscurity”.
Apart from that, Linux is very popular, just not on the Desktop. It is therefore not obscure in the sense of popularity either, at least the components which are hit by the bug mentioned in the article.
That doesn’t make any sense as argument no matter how you spin it. Linux is the dominant system for servers for decades now, and a Debian Desktop is quite literally the same as Debian on a server except it also got a GUI of your choice slapped on top. There’s absolutely nothing obscure about it, neither did anyone from the kernel team (Linux), FSF (GNU utils) nor IBM / Red Hat (systemd & honestly way too much other stuff) etc. ever design something around STO. That’s a domain firmly situated in proprietary code since for FOSS it doesn’t make sense to begin with. The false errand of GRUB is the sole exception, well known and solved.
The desktop market share says absolutely nothing about what you’re trying to argue. Now if you were to argue that Linux is lacking in terms of desktop software isolation then you’d have a point, things like Flatpak still are addressing lots of issues. But to say “Linux” approaches security with obscurity is total nonsense.
There was never an actual notion of “security through obscurity”. LInux runs the complete Internet and most coporate server infrastructure. That’s where the actual money is.
People hallucinating that Linux is something obscure simply have no clue and confused their home desktop for real computing. Windows desktops are constantly targeted not because they are -unlike Linux- so wide-spread but because they are already insanely insecure. They are the low hanging fruit where you can cobble together some cheap shit and will still find million of PCs vulnerable. If you want to find a Linux comparison it’s definitely not server or desktops but cheap IoT devices not having seen an update (or any security to speak of) for many years.
For reference: We are talking about guests in a virtual pc escaping it’s container. That’s not something obcure. That’s basically all cloud hoster’s whole business model, thus the reason Google pays a lot of money for finding such exploits.
Windows desktops are targeted because any place you have a user, you have a vulnerability. The vast majority of Linux installs are servers with extremely limited user activity, which narrows the attack vectors significantly.
The actual notion of “security through obscurity” (that will surely come up on Google if their AI bullshittery hasn’t screwed up completely…) for Linux is insane because open source is the polar opposite. By that definition proprietary code is actually much more linked to the concept.
The often more unprecise and colloquial usage I thus assumed you were using doesn’t apply either, for the reasons I summarised.
So which imaginary definition of “security through obscurity” are you using and assuming that it will come up on Google when none of the real ones makes any sense?
In security engineering, security through obscurity is the practice of concealing the details or mechanisms of a system to enhance its security. This approach relies on the principle of hiding something in plain sight, akin to a magician’s sleight of hand or the use of camouflage. It diverges from traditional security methods, such as physical locks, and is more about obscuring information or characteristics to deter potential threats. Examples of this practice include disguising sensitive information within commonplace items, like a piece of paper in a book, or altering digital footprints, such as spoofing a web browser’s version number. While not a standalone solution, security through obscurity can complement other security measures in certain scenarios.
You don’t know what you’re talking about - please stop. It’s embarrassing. It’s a long-standing industry term not some weird phrase I just made up. Nobody is saying “Linux is obscure”.
You quoted something directly contradicting what you said. Nothing is concealed, every line of erroneous code could have been analysed for 15 years. All information needed to find the bug was public since it the code has been written and checked in publicly.
the practice of concealing the details or mechanisms of a system to enhance its security
That’s literally the opposite of what open source and Linux does, though. Anyone can see how it works, so they have to have actual security instead of relying on security through obscurity.
How about scrolling up to the exact comment I anwered to? Or -as you seem to be on the exceptional dense side- let me do it for you…
Linux’s “security through obscurity” was never going to last.
As already explained above I did not expect that statement to use the common “long-standing industry term” because -again- it would be utterly insane to claim security through obscurity for something open source.
The selfhosted guys are correct with that. Of course its not a magic pill, but it can help to minimize the attack surface immensely with little effort.
Edit: while open ports can easily be enumerated, a reverse proxy often requires knowledge of the right server name. In tls1.3 those are not transferred in clear. Depending on your thread scenario you might want to consider doh/dot etc.
Reverse proxies can require client certs, which lift the security benefit to something like a vpn. Even basic auth adds a high threshold to attackers and is simple even for random users to work with. All this is functionality many services don’t offer natively - as they assume a reverse proxy anyway I guess.
As if a proxy blindly passing traffic directly to a backend server “reduces attack surface” in any meaningful way. 🙄
Edit: Guy edits his post with a bunch of stuff and assumes I’ve read it later. I can’t eyeroll enough…
You’ve increased your “attack surface” by adding a second application to the stack. Proxies aren’t magic, they are also targets.
Sure - you can do those things on a proxy. How many people here are? And why are those things never suggested when people here say “use a reverse proxy”? Because they think the proxy is the security.
Sorry - which part of your comment added anything of value? “can help to minimize the attack surface”? 99% of the time a proxy just passes traffic through. Unless you’re talking about a WAF which is a) a different thing and b) NOT what any home gamers are talking about when they recommend nginx, traefik, etc. to newbs.
Linux’s “security through obscurity” was never going to last.
Edit: it’s a common concept in hacking. Shorthand for a type of security through improbability.
I lost braincells reading this. The entire point of open source software is to have it visible and auditable, aka the exact opposite of security through obscurity.
If you want to bash OS’s for relying on STO, go after iOS and Windows. Those OS’s, being closed source, are the ones relying on it
I don’t think that word means what you think it means.
I don’t know where you got the notion from that Linux as a whole uses this concept, but it’s nonsense. There’s exactly one place where this definition fits, which is the GRUB bootloader encryption (which merely shifts the target for the Evil Maid attack from the initramfs to GRUB). But this is already adressed with Verified Boot.
Nothing else, let it be LUKS, PAM, SELinux, AppArmor or whatever has any business with STO.
From the fact it used to have to smallest user base of the big three. Less users = less probability of a nefarious person.
It’s really not that difficult a concept. I’m surprised people here are asking what it is.
You confused “obscurity” as in a synonym for low popularity with the word “obscurity” as in people not knowing how it works and people deliberately hiding the inner workings of a system.
Everyone using Linux can know how it works, that’s the opposite of obscurity in the sense it is used within “security by obscurity”.
Apart from that, Linux is very popular, just not on the Desktop. It is therefore not obscure in the sense of popularity either, at least the components which are hit by the bug mentioned in the article.
That doesn’t make any sense as argument no matter how you spin it. Linux is the dominant system for servers for decades now, and a Debian Desktop is quite literally the same as Debian on a server except it also got a GUI of your choice slapped on top. There’s absolutely nothing obscure about it, neither did anyone from the kernel team (Linux), FSF (GNU utils) nor IBM / Red Hat (systemd & honestly way too much other stuff) etc. ever design something around STO. That’s a domain firmly situated in proprietary code since for FOSS it doesn’t make sense to begin with. The false errand of GRUB is the sole exception, well known and solved.
The desktop market share says absolutely nothing about what you’re trying to argue. Now if you were to argue that Linux is lacking in terms of desktop software isolation then you’d have a point, things like Flatpak still are addressing lots of issues. But to say “Linux” approaches security with obscurity is total nonsense.
Security through obscurity in OSS lol
There was never an actual notion of “security through obscurity”. LInux runs the complete Internet and most coporate server infrastructure. That’s where the actual money is.
People hallucinating that Linux is something obscure simply have no clue and confused their home desktop for real computing. Windows desktops are constantly targeted not because they are -unlike Linux- so wide-spread but because they are already insanely insecure. They are the low hanging fruit where you can cobble together some cheap shit and will still find million of PCs vulnerable. If you want to find a Linux comparison it’s definitely not server or desktops but cheap IoT devices not having seen an update (or any security to speak of) for many years.
For reference: We are talking about guests in a virtual pc escaping it’s container. That’s not something obcure. That’s basically all cloud hoster’s whole business model, thus the reason Google pays a lot of money for finding such exploits.
Windows desktops are targeted because any place you have a user, you have a vulnerability. The vast majority of Linux installs are servers with extremely limited user activity, which narrows the attack vectors significantly.
In any system, the human is usually the weakest link.
You could have just said that you don’t know what “security through obscurity” is.
You are right. I don’t know what your personal definition of “security through obscurity” is as it’s very obviously not matching actual reality.
Just google the term next time rather than embarrassing yourself.
Yes, please do.
The actual notion of “security through obscurity” (that will surely come up on Google if their AI bullshittery hasn’t screwed up completely…) for Linux is insane because open source is the polar opposite. By that definition proprietary code is actually much more linked to the concept.
The often more unprecise and colloquial usage I thus assumed you were using doesn’t apply either, for the reasons I summarised.
So which imaginary definition of “security through obscurity” are you using and assuming that it will come up on Google when none of the real ones makes any sense?
OMG.
https://en.wikipedia.org/wiki/Security_through_obscurity
You don’t know what you’re talking about - please stop. It’s embarrassing. It’s a long-standing industry term not some weird phrase I just made up. Nobody is saying “Linux is obscure”.
You quoted something directly contradicting what you said. Nothing is concealed, every line of erroneous code could have been analysed for 15 years. All information needed to find the bug was public since it the code has been written and checked in publicly.
That’s literally the opposite of what open source and Linux does, though. Anyone can see how it works, so they have to have actual security instead of relying on security through obscurity.
How about scrolling up to the exact comment I anwered to? Or -as you seem to be on the exceptional dense side- let me do it for you…
As already explained above I did not expect that statement to use the common “long-standing industry term” because -again- it would be utterly insane to claim security through obscurity for something open source.
Security through what now?
Well, I guess it is obscure… Though only because the number of people who have a full grasp on how the code works is highly limited.
The self-hosted crowd thinks reverse proxies protect you from the Internet. Don’t expect too much of them.
The selfhosted guys are correct with that. Of course its not a magic pill, but it can help to minimize the attack surface immensely with little effort.
Edit: while open ports can easily be enumerated, a reverse proxy often requires knowledge of the right server name. In tls1.3 those are not transferred in clear. Depending on your thread scenario you might want to consider doh/dot etc.
Reverse proxies can require client certs, which lift the security benefit to something like a vpn. Even basic auth adds a high threshold to attackers and is simple even for random users to work with. All this is functionality many services don’t offer natively - as they assume a reverse proxy anyway I guess.
See what I mean?
As if a proxy blindly passing traffic directly to a backend server “reduces attack surface” in any meaningful way. 🙄
Edit: Guy edits his post with a bunch of stuff and assumes I’ve read it later. I can’t eyeroll enough…
Did you just add ‘blindly passing traffic’ to your statement? Did you read my comment about can help?
Move on, joker.
Sorry - which part of your comment added anything of value? “can help to minimize the attack surface”? 99% of the time a proxy just passes traffic through. Unless you’re talking about a WAF which is a) a different thing and b) NOT what any home gamers are talking about when they recommend nginx, traefik, etc. to newbs.
Lol
Enjoy your “security”. 🙄
You can’t be real 😂 best laugh I’ve had in a while. Thanks for that.
You are right about that a reverse proxy does not protect. But I can not relate that with security through obscurity.