Oddbean

This read gives me serious creeps. Really solidifies why airgapped cold storage is an absolute must. I see funds stored on lightning nodes differently after reading this. Up for grabs so to speak. This read humbles a person who thinks they have a decent understanding on security topics but isn't a professional in that field. nostr:nevent1qqst96tsjej9qj2wqhp2np738d2z26daqhd9pgeclefd9wmrxuallespp4mhxue69uhkummn9ekx7mqzyzqhzjxrdyq42sqmf9zcppclkpty5ha2lw29fqf7722lyurteye4jqcyqqqqqqgcdfr3k

Security in linux derives from minimalism. All other OSs have a bunch of software and services installed by default. You can make a distro as minimal as possible and harden it as much as you can. Minimalism also makes it easier for the user to grokk the whole system and better understand how to defend it. When you use a more "secure OS" you're essentially relying on a complex blackbox to protect you, it's "custodial" security. Yes, linux security hinges on the fact that the user is expected to know what he's doing so that he does not shoot himself. That's a valid criticism but does not make it intrisicly insecure, just not noob-proof.

True, but the article points out multiple architectural flaws which cannot be resolved by "manual hardening". It's pointed out that knowing how syscalls and such work helps of course with sandboxing applications manually, but that isn't enough with all the unpatched vulnerabilities in the kernel itself.

Every system has "architectural" flaws, 0days and CVEs, that's just a normal day in infosec. What matters is in practice and in the wild. The fact most internet infrastructure uses Linux is not some collective delusion based on a "common security misconception". It's years of practical experience at play. If they were really better off using some other OS, the free market would guide it towards that.

That's a very good point. Even if so many kernel vulnerabilities are known but just not fixed like the article claims. And even when there supposedly are teams who can penetrate into any system on the globe if given enough time, that shouldn't be on the threat model of 99.9% of the people. I think the most prudent action for the security oriented pleb is to just start using Qubes and some airgapped cold storage method.