logoalt Hacker News

blablabla123 • today at 10:39 AM • 1 reply • view on HN

Most system installed software can normally not access everything because of the filesystem permissions. It works surprisingly well.

I think the problem is the trend of installing everything in the home directory. Ruby with rvm, Node with nvm/asdf/..., Rust with rustup, ... the list is long and of course related to rapidly changing ecosystems. If the underlying technologies were to strive for more stable designs, you could as well install them in /usr through the distribution's semi-outdated packaging system. In the past this was considered a hallmark of stability, now it's considered a limiting factor.

Of course all these innovations were mostly developed with servers in mind but not so much with Desktop usage.

The other problem with containers on Linux is that they are only sandboxes when configured correctly. Otherwise they can be even worse than no container.


Replies

bpfrh • today at 10:46 AM

The security issue has not really anything to do with where you install something, but that when you run something it has access to everything you have.

Linux needs fine grained easy to use permissions, on desktop _and_ servers, there is a reason there is a high investment in container technologies and there is selinux and apparmor.