Virtual Machine

[Bonobo]

[..] OSX is my OS of choice as well. Unfortunately, its pricey [..]

“pricey”, as in “good shoes” for which I pay perhaps 20 or 30 € more but which last for decades instead of only until next year way better than “cheap”, and way more savings in the long run, if you ask me.

[..] paranoid is never a good description for security. [..]

Correct. All we need is a sane level of security

Cordially, Tom

[RobertJasiek]

I.e., better than GCHQ, NSA and criminals.

[RBerenguel]

I.e., better than GCHQ, NSA and criminals.

Using any computer connected to the net could be a liability, w.r.t. the NSA. Looks like they have been tampering with servers/routers recently, for instance. Being really paranoid, what prevents them forcing Intel/AMD to install hooks directly at processor level? Or between processor and memory. Or...

I always take the approach of, well, not doing anything that is remotely interesting to a security agency, or even to a criminal, except for online banking. I'd love to have enough money so I could worry about someone stealing my online banking credentials, but as it stands it's easily covered by standard, bank insurance for these cases.

[Bantari]

[..] OSX is my OS of choice as well. Unfortunately, its pricey [..]

“pricey”, as in “good shoes” for which I pay perhaps 20 or 30 € more but which last for decades instead of only until next year way better than “cheap”, and way more savings in the long run, if you ask me.

I disagree.
A Mac is much more expensive than a PC, not only by 20 or 30 €. I can buy a PC laptop for ~$200-$300, while the low-end Mac is what? Around $900 - which is 3-4 times the price. Even if you want to get a PC laptop with comparable parameters - it will be $400-$600 depending on the brand and packaging. This is a big price difference.

Durability is also not an issue. These days - Macs have exactly the same components inside as PCs, so there is very little hardware difference. As a matter of fact, I have Windows boxes which are much older than all my Macs put together - and they still work great (whenever need to get my courage together to fire them up or feel nostalgic about some old games.)

Additionally, the same software tends to be more expensive in its Mac version than a PC version. For example: Adobe Creative Suite ~$300 for PC and ~$500 for Mac, MSOffice for PC ~$80, for Mac ~$130, and so on... its a huge difference, sometimes almost twice the price.

Then there is the whole thing of software availability. VM is a good solution for some applications, but cumbersome for other - this is why many have to use actual Windows PC rather than running Windows in a VM.

The biggest difference, for me, in running a Mac over a PC is the OS, not the hardware. And this is what I am willing to pay for. Its just so smooth... no registry, you install stuff and it just works, you want to uninstall and deleting a single folder does it cleanly, stuff like that. No hangups. And the fact that it is built on top of Linux, which makes it more secure and more stable - no more viruses, no more malware - haven;t have to worry about it in all those years I used a Mac - which is awesome, no more Windows hassle!!! That, and my work combines Linux-based development with strong graphical needs, which makes a Mac ideal for me.

Still, from my observation - the price difference is, for many, a very big factor.
And I have to admit that a Mac is not always ideal for everyone for other reasons as well.

But if it comes to security - both Mac and Linux beat the pants off of Windows. If for no other reasons that nobody really bothers writing viruses and malware for Linux, while the whole world seems to be busy cracking Windows left and right and center. So even if somebody does not believe in the inherent security advantage, the numbers themselves work in heavy favor of Linux/Mac over Windows. I know, I have been running both for ages (and yes, the CP/M as well) - and the hoops I have had to jump with Windows were very tiresome. I do the same with my Macs now and for the last 5-6 years of heavy use, not a single problem, not a single malware, not a single virus, nothing. With Windows, in spite of all the hoops, I had to clean it up twice a year, on average, sometimes more, because the system got unusable from all the crap it lets through when you just simply use it.

So my advice is - if you are fixated on security, go Mac. If you want cheaper - go Linux, same difference just not as flashy. If you want to use Windows, you get what you deserve, and you need a two page small-print precautional procedure on how to copy a file. Its the choice you make.

[RobertJasiek]

A safely configured Windows PC combined with "think before you act" prevents malware, as everybody doing so reports (me too). You say that Linux or Mac would be more secure per se; you need to provide reasons for that. (I know that there is less malware for them, but this is not a sign of security of the operating systems. Tomorrow it could change.)

Let me guess: you mean something else. That out-of-the-box Linux or Mac would be safer than out-of-the-box Windows. Maybe.

[RBerenguel]

Robert, Mac and/or Linux, out of the box are safer because they implement most of your user-sandbox-execution restrictions natively, forced well within all levels of the system, without having to do anything. There's essentially no need for me to worry that an anonymous downloaded app can access kernel-related files and tamper with them: they are property of the root user, and not even I can modify them directly. Since applications run on the user level, they can't do everything unless granted permission to do so (and in Mac OS you can query exactly what permission they are asking.) Likewise for most of your setup: in Linux/Mac OS or any other Unix-derived operating system (even Plan9) most of it comes for granted, and doesn't require a huge, time-costly setup investment. Essentially you are mimicking user groups and execution restrictions in an operating system that wasn't initially designed for them, and we say that our operating systems (which were designed first and foremost for it) are safer because of it.

In any case, I think we've had this discussion before, and since it works for you and you are happy with it, I don't think we all *nix zealots need to keep forcing the bitter medicine down your throat. If it works, it's usually better not to change it.

[Bantari]

Robert, Mac and/or Linux, out of the box are safer because they implement most of your user-sandbox-execution restrictions natively, forced well within all levels of the system, without having to do anything. There's essentially no need for me to worry that an anonymous downloaded app can access kernel-related files and tamper with them: they are property of the root user, and not even I can modify them directly. Since applications run on the user level, they can't do everything unless granted permission to do so (and in Mac OS you can query exactly what permission they are asking.) Likewise for most of your setup: in Linux/Mac OS or any other Unix-derived operating system (even Plan9) most of it comes for granted, and doesn't require a huge, time-costly setup investment. Essentially you are mimicking user groups and execution restrictions in an operating system that wasn't initially designed for them, and we say that our operating systems (which were designed first and foremost for it) are safer because of it.

In any case, I think we've had this discussion before, and since it works for you and you are happy with it, I don't think we all *nix zealots need to keep forcing the bitter medicine down your throat. If it works, it's usually better not to change it.

Yes, that! Exactly.

But, if you (RJ) rather go through lengthy setups, manual registry cleaning, and 2-page procedures for copying files, suit yourself. people just try to offer you advice here, if you take it or not - its your problem.

Personally, I rather use a system with less hassle than have hassle to try to imperfectly mimic such system and then have to go through more hassle to use that system. But whatever rocks your boat, its all good.

[Bantari]

A safely configured Windows PC combined with "think before you act" prevents malware, as everybody doing so reports (me too). You say that Linux or Mac would be more secure per se; you need to provide reasons for that. (I know that there is less malware for them, but this is not a sign of security of the operating systems. Tomorrow it could change.)

Let me guess: you mean something else. That out-of-the-box Linux or Mac would be safer than out-of-the-box Windows. Maybe.

As a matter of fact - I want to say much more that that.
What I want to sat is that out-of-the-box Mac is at least as safe as the Windows system you have, with all your precautions and restrictions and multiple drives and whitelists and sandboxes and whatnot.

Here is why I think so:

I assume you felt the need to implement all your precautions because you either had or expected problems which could only be prevented by taking all these measures. I also assume that since you implemented all that you implemented, you had no problems.

Well, on my out-of-the-box Mac I also have had no problems, ever since I started using it six or seven years ago. I bet that my computer usage is at least as heavy and "dangerous" as yours - it is often in the course of my work that I have to download and test 3rd-part applications or code libraries, or various plugins and addons. I also do that in the course of my non-work-related functions, i.e. for fun and pleasure. I feel free to browse the web indiscriminately without worry of viruses or malware/spyware/adware/whatever. I also feel free to open my email attachments, and store my emails in binary format, and all that. All the stuff that you caution to be cautious about, I simply don't (need to) worry about.

Still - not a single problem. Which is on par with your system!

The difference is - absolutely no hassle on my part!
I never once had to manually adjust anything because I was afraid or suspected something amiss. I never once had to even look at the registry, let alone manually clean it up (guess what - no registry.) I never once had to clean up after uninstalling an application - its all a matter of just deleting a single folder, and bye-bye. I never once had to worry about copying a file from one folder to another, I do not need multiple drives or partitions, and so on, all the way down your very long and complicated list.

And still, with respect to any problems, my system is at least on par with yours - which means: no problem!

So, this is pretty much what I was trying to say.
But, as RBerenguel says - I am not trying to cram Linux or Mac down your throat. If you like Windows and all its twisted ways, if you like following 2-page procedure to copy files, its all good with me, carry on and have fun.

[RobertJasiek]

Every OS has bugs, and, ALA they are not fixed by OS updates, they are a security gap - unless additional security configuration has taken precaution.

Windows registry: you confuse Windows 95 days (when registry cleaning tools were popular) with Windows NT 6.x days. Nowadays, registry settings need to be changed a) if a power user wants a particular arcane setting, b) a program's deinstallation routine is crap (I agree that the Mac's simply delete a folder approach is much preferable) or c) a program is outrageous and takes more rights than it should (then manual refinement can be needed to get security right again).

If you are careless about email attachments etc., then you can be hit by a malware exploiting an OS bug. So far, you have been lucky mainly because such malware is scarce for the Mac. No NSA backdoor introduced by Angry Birds yet? Sure?:) On my Windows system, I am sure, because I check system files' integrity etc.

Which 2 page instruction to copy files? Such is needed only for new external, executable files. That you do not apply similar precautious leads to 0-day-exploit risks.

[MJK]

How about this. Let me make a suggestion.

1. Not every single file in your computer needs to be protected or be unseen by others.
2. Suppose there is an important text file 'haha.txt' which has your bank card PIN number and email password written down.
3. You don't want others to be able to access this information.
4. Encrypt 'haha.txt' using some modern cryptographic algorithms.
5. You can do this with some freeware programs or also by yourself with enough programming skills and algorithm understanding.
6. Keep your own key required for decryption in mind.
7. You might worry about some brute-force key guessing methods, but there are plenty of ways to prevent it.
8. Unless someone tortures you to spit out the correct key, or the key is your birthday, 1234, 1111 et cetera, then everything is safe.

[RBerenguel]

How about this. Let me make a suggestion.

1. Not every single file in your computer needs to be protected or be unseen by others.
2. Suppose there is an important text file 'haha.txt' which has your bank card PIN number and email password written down.
3. You don't want others to be able to access this information.
4. Encrypt 'haha.txt' using some modern cryptographic algorithms.
5. You can do this with some freeware programs or also by yourself with enough programming skills and algorithm understanding.
6. Keep your own key required for decryption in mind.
7. You might worry about some brute-force key guessing methods, but there are plenty of ways to prevent it.
8. Unless someone tortures you to spit out the correct key, or the key is your birthday, 1234, 1111 et cetera, then everything is safe.

Rootkits, keyloggers, physical tampering can bypass this easily (technically I think Robert's setup can't prevent physical tampering though).

[RobertJasiek]

Dynamic encryption is a useful additional means if the more basic means of security are given, so that malware cannot watch or manipulate the encryption process.

Static encryption prevents physical access to a PC from being directly useful.

Important passwords should not be protected (only) by encryption, but it is better to not store them on the PC permanently.

[Bantari]

Every OS has bugs, and, ALA they are not fixed by OS updates, they are a security gap - unless additional security configuration has taken precaution.

Windows registry: you confuse Windows 95 days (when registry cleaning tools were popular) with Windows NT 6.x days. Nowadays, registry settings need to be changed a) if a power user wants a particular arcane setting, b) a program's deinstallation routine is crap (I agree that the Mac's simply delete a folder approach is much preferable) or c) a program is outrageous and takes more rights than it should (then manual refinement can be needed to get security right again).

If you are careless about email attachments etc., then you can be hit by a malware exploiting an OS bug. So far, you have been lucky mainly because such malware is scarce for the Mac. No NSA backdoor introduced by Angry Birds yet? Sure?:) On my Windows system, I am sure, because I check system files' integrity etc.

Which 2 page instruction to copy files? Such is needed only for new external, executable files. That you do not apply similar precautious leads to 0-day-exploit risks.

Its just like you to "conveniently overlook" the most important part: NO HASSLE!
Of course, you can add minimal hassle to have my system much more secure.
You seem to like hassle.

PS>
Never played Angry Bird, don't even know what it is, really. From what I read, it is hyped to introduce a bug which allows NSA to watch what I do. Personally, I don't really mind them watching if they do. If it helps them do their jobs, not sure why people are so frantically scared of it. But this is a topic for another discussion.

[lemmata]

Oops wrong thread.

I meant to say here that I play on some servers using an Android VM. It's kinda fun.

[Charlie]

I feel obliged to mention that an attacker with physical access to a machine is widely considered to have free reign over it. Call this a computer security proverb, if you will.

Merely the inability to natively execute PE-code protects Linux from 99% of the threats in the wild. (I presume the same holds for Macintosh) It also won't execute VB-script and doesn't feature the Windows Registry or COM or its evil nephew, ActiveX, or Office Automation or Internet Explorer. Linux is definitely more secure, out-of-the-box.