It's a different approach to security. There are no malicious apps in GNU/Linux repositories. (And yes, Linux security should be improved; I run Qubes on desktop)
https://source.puri.sm/Librem5/docs/community-wiki/-/wikis/F...
It's a different approach to security. There are no malicious apps in GNU/Linux repositories. (And yes, Linux security should be improved; I run Qubes on desktop)
https://source.puri.sm/Librem5/docs/community-wiki/-/wikis/F...
> There are no malicious apps in GNU/Linux repositories.
That's definitely not the case. There have been repeated cases of developers shipping malicious code which ended up in distribution package repositories. Defining malicious is difficult and incredibly privacy invasive behavior is often not considered to be malicious. That software is also generally being used without a mandatory app sandbox with a proper permission model, so it can access whatever it wants for the most part beyond self-imposed restrictions.
There are similarly maintained package repositories for Android such as F-Droid. It adds the people doing packaging as trusted parties. Contrary to common misconceptions, Linux distributions and F-Droid are not meaningfully auditing/reviewing the upstream code and therefore not actually significantly reducing trust in the upstream projects. There substantial delays for updates with how most are maintained, so that gives time for external parties to find issues but doesn't mean it won't be packaged and shipped anyway.
> incredibly privacy invasive behavior is often not considered to be malicious
This is not true for Debian, which is the upstream of PureOS.
> therefore not actually significantly reducing trust in the upstream projects
And yet, it has practically negligible number of malicious apps, especially compared with Google Play. It's far from perfect, and you are right that the sandboxing should be further improved. Nevertheless, it is a security model working in practice for a large userbase of Debian. It works especially well for technical users.
> This is not true for Debian, which is the upstream of PureOS.
Lots of the software they provide has privacy invasive behavior and far more than that has poor privacy.
> And yet, it has practically negligible number of malicious apps, especially compared with Google Play.
Google Play is not the only app repository for Android-based operating systems. There are repositories in the style of traditional Linux distributions and also better approaches available.
> Nevertheless, it is a security model working in practice for a large userbase of Debian.
No, it has very poor privacy and security.
> It works especially well for technical users.
Being technical doesn't address the massive privacy and security issues. It only makes it less likely people install blatant malware instead of it being a problem through supply chain attacks and very poor security throughout the OS.
> Lots of the software they provide has privacy invasive behavior and far more than that has poor privacy.
You can't attack Debian like this without providing a few examples.
> No, it has very poor privacy and security.
This is just an empty accusation. Have you seen serious security problems in Debian with any noticeable consequences recently?
>It's a different approach to security
That's like saying using a hole in a wall is a different approach to security than putting a lockable door in a wall. Sure no security is s different approach to security, but it's not an effective one.
>There are no malicious apps in GNU/Linux repositories
Maybe not intentionally malicous, but there have been bugs that can cause applications to act maliciously such as deleting users files. If an application gets exploited it could also do malicous things. Just because you trust the author of a program, that doesn't mean that sanboxing is pointless. Additionally programs like the terminal are a free for the user to run things like curl | sh which can run malware infecting the system and run wild since there is no security to stop it from doing almost anything.
>Purism
The wiki page pretty much says that they don't have privacy or security and don't have the resources to implement such features unlike Google or Apple. They also make some claims to try and pretend their platform is secure and private in order to help sell the Librem 5, a product they made with inferior privacy and security compared to Android.
I hope you consider strict threat modeling when deciding which approach to security is preferred. How about a threat of Google removing your control of the OS [this thread] and [0]? Or Google delaying security patches [1]?
[0] https://news.ycombinator.com/item?id=45017028
[1] https://news.ycombinator.com/item?id=45208925
>Google removing your control of the OS
That is a feature of Play Services and not a part of AOSP which is what we are talking about.
>Or Google delaying security patches
Like it or not coordinated vulnerability disclosure is a thing in the industry and is done by other Linux distros too.
This is not "coordinated vulnerability disclosure". It's waiting for slow vendors at the risk of everybody else.