- zurohki@aussie.zoneEnglish5 days
Yeah, Wine is not a secure container. Don’t count on it for security.
- TheSyndZ@lemmy.dbzer0.comEnglish5 days
Isn’t a way possible to prevent z:/ mapping while creating wine prefix ?
- zurohki@aussie.zoneEnglish5 days
It’s not just the drive letter mapping, Wine doesn’t make any attempt to secure software.
You can run Wine inside an actual security solution.
- Aceticon@lemmy.dbzer0.comEnglish5 days
All my Windows games that I launch from Lutris (which are most, since I tend to avoid Steam and prefer GOG) are launched by default inside a Firejail container configured amongst other things to have no networking enabled.
All you need to do for it is to setup a “command prefix” with firejail and its launch parameters at the Lutris level and it becomes the default one for all games.
So yeah, this runs Wine inside an actual security solution and since it’s setup at the level or the launcher I use, it does it for all the games I launch from it.
I guess not allowing flatpak wine to access anything that is not necessary is the easiest way to achieve it. No idea if it is also the most secure solution.
- 5 days
Here’s a careful reminder that Linux viruses can come in Windows executables.
When it comes to hacking in the modern day it’s all about escaping the box - whether that box is a container, a VM, a sandbox or indeed even an emulated environment. So we should still fear the binary blob.
Remember: update early, update often - no matter how painful that sounds.
- 5 days
Remember: update early, update often - no matter how painful that sounds.
Not anymore! Supply chain attacks have become so common that it’s prudent to wait at least 7 days before updating to prevent installing malware from compromised update infrastructure.
- dgdft@lemmy.worldEnglish5 days
Debian + unattended upgrades + modern package managers for non-system-installed software covers your bases very well.
Debian packages are downstream enough from their sources that the packaging delay keeps you safe (and means the updates have had human eyes on them before they hit you). Unattended upgrades means you don’t have to worry about running the upgrades yourself.
Pip, npm, and the other big package managers now also support dependency cooldowns on their recent releases, but uv and pnpm pioneered that and cover you for older release environments.
Also I would heavily advocate for Debian Testing if you need a rolling release distro. It is less vetted than stable but is still more vetted than many other rolling release options and you can just stay on testing as versions change while getting features pretty fast compared to stable.
- 4 days
Hardened systems with hardware enforced isolation (virtualization and stuff)
- 5 days
I really like Arch because I have a very custom setup and like to try the newest things, but this really worries me as Arch-based user-friendly distros that use the same packages make the repos a bigger target.
- signalsayge@infosec.pubEnglish5 days
On the other hand, AI has made the patch to exploit code as short as 45 minutes.
- DevDave@piefed.socialEnglish5 days
I switched from Debian to an arch based distro. holy shit is it weird reading about some new things latest release only to have it pushed to the repo the same month or even the same day! I use btrfs so when things break its a 5 minute rollback and reboot.
- dgdft@lemmy.worldEnglish5 days
You’d still be fine if you’re not exposing public services or visiting actively-malicious websites.
- 5 days
You are underestimating things. Unmalicious websites can still host malicious content by users, for example.
- dgdft@lemmy.worldEnglish5 days
Okay, wanna give me a link to a PoC example you set up?
I’ll reimage my laptop to an old Ubuntu ISO of your choice, and visit your link. Happy to be proven wrong.
- 5 days
No, I will not spend hours of my time to win an irrelevant internet argument. :P
- dgdft@lemmy.worldEnglish5 days
Fair enough!
But I can tell you as a cybersecurity expert that you’d have a hard time finding a way to get any sort of remote execution from user-generated content on any major site, much less an exploitable browser sandbox escape.
I read a hilarious article, probably 2 decades ago by now, where a guy decided to try running Windows viruses on Linux in Wine.
If this really is a threat today, I would say that Wine has become a pretty damn impressive project. Here’s the link in case anyone else wants to read it: https://entertainment.slashdot.org/story/05/01/26/219201/running-windows-viruses-under-linux
- 3 days
Sadly newsforge (the site linked in the above article) no longer hosts said article. Sounded like a fun read!
- dgdft@lemmy.worldEnglish5 days
There’s never been an instance of widespread malware built with a dedicated ability to persist on a Linux host through Wine.
It wouldn’t be hard at all for a hacker to manually wire up linux-specific malware on a computer once they had a RAT running in Wine, but there’s no credible risk of windows malware automatically installing “linux viruses” at present.
- 5 days
Thank you Lemmy devs for just allowing to download videos and images. Fuck reddit
- 3 days
I prefer reddit UI but the community is annoying asf. No one has the mental capacity to discuss and the emotional control of a toddler.
Not paywalled, just straight up preventing it, which they have been doing for years now. But yt-dlp still works for downloading from reddit, if so desired.
Oh I think we migrated around similar times then (I’m a lemm.ee refugee). I thought you were surprised that photos and videos were available to download when this wasn’t a recent lemmy change
- KernelTale@programming.devEnglish5 days
yea, I play pirated games via flatpak bottles in hopes that getting out of the sandbox would be far too much work for the possible gains.
- 5 days
Hmmmmmm, maybe the virus shouldn’t use GTK dialogs for opening files and call open(3)? hmmmmmmmmmmmmmmmmmm
- 5 days
Type
man 3 open.That’s what most Flatpak apps may do instead of asking permission via a fancy menu, which actually just does the same thing.
- 5 days
My linus virus trying to fuck up my disk on nixos (coreutils isn’t in the path)
5 daysIsn’t your user data available in Wine on Z:\ though? I laughed at the meme but I’d still be worried info stealer malware or similar would have no problem grabbing the data it’s looking for as Wine does no sandboxing at all.
- WhyJiffie@sh.itjust.worksEnglish5 days
you can remove the Z drive letter, but that’s not enough. Nothing prevents a windows program from attempting to call linux syscalls
Yeah, I’m sure some malware would fail on wine but some could still be just as bad compared to running windows natively.
- 5 days
Flatpak bottles can use wine in a sandboxed environment. Both flatpak and bottles have ways to restrict access to parts of the filesystem.
- Ghoelian@piefed.socialEnglish5 days
Yea im pretty sure thats the point. The virus will get a drive that has nothing but the infected game on it.
- WhyJiffie@sh.itjust.worksEnglish5 days
more correctly every wineprefix. Depending on how you install games, they might not be running in separate wineprefixes, but I believe steam does it that way
Jokes on them, even when I ran windows my os wasn’t on C, I think it was like E
- 5 days
Proton for some reason insists in mounting root on Z. Plain wine doesn’t care. So I had to use firejail.
- 3 days
Well, how else do you want to achieve 100% compatibility? Don’t discriminate the viruses like that!
