The obsessive drive for heightened security by Ubuntu

Lounge
1

There is an obsessive drive by Ubuntu and it’s developers to prioritise enhanced security over usability.
This is understandable on server systems where security is paramount, but in desktop only situations this obsession is starting to seriously impact on the usability of all Ubuntu systems.

Am I the only one who has noticed this and been impacted by this?

I first noticed it when the Kubuntu team suddenly decided to cripple Dolphin by removing root access several years ago.
Then gradually the changes started coming thick and fast. Now we have Rust, the demise of sudo, the introduction of snaps, Wayland with all it’s issues with Nvidia becoming the default without an option for xorg on installation and thousands of nvidia installs just getting black screens at first boot- the list just goes on and on.

I understand that software has a shelf life and old ways must give way to the new, but I am utterly bemused by this obsession with security. Linux is inherently far more secure than others, and to prematurely remove tried and tested solutions and introduce the new without allowing sufficient time to iron out all the bugs with the old system being removed is just so counter-productive to the stated aim of increased desktop usage for linux.

Do the developers seriously think that a user moving from Windows is concerned primarily about security? No - they want usability primarily.

2

I’m no expert, but my understanding is that Linux is more private than Windows, iOS, ChromeOS and stock Android, which spy on you by design, but for the most part less secure, with Debian-based distros being less secure than Red Hat-based distros:

https://madaidans-insecurities.github.io/linux.html
https://privsec.dev/posts/linux/choosing-your-desktop-linux-distribution/

I’m not sure, then, that I find an emphasis on improving Ubuntu’s security misplaced.

2 Likes
3

Hi @vidtek99 - you’re not wrong, but you’re also not entirely right! :wink:

You and I have both experienced many winters in the Linux world. We remember when Linux is secure was all the antivirus we needed, and sudo felt like a brand-new safety feature. But the game has changed. The “obsessive drive for security” you’re talking about isn’t an obsession; it’s an arms race.

My philosophy on this, especially after a recent stint in the security biz, comes down to this: We give you the gun and the bullets, but it’s our job to put the safety on by default. If you choose to load the weapon and shoot it at your foot, that blame entirely lies with you.

Take the infamous Dolphin-as-root change. That wasn’t about “crippling” Dolphin. It was about putting the safety on. Why? Because letting a GUI with the complexity of a modern file manager run with god-mode privileges is the digital equivalent of juggling loaded pistols. Can you do it? Sure. Should it be the default, easy option? Absolutely not.

For those of us who know what we’re doing and accept the risks, the workarounds exist. We know how to flip the safety off. The change was for the 99% of users who don’t realize they’re about to shoot their foot off.

Do the developers seriously think that a user moving from Windows is concerned primarily about security? No - they want usability primarily.

This is the crux of it, isn’t it? And my answer is: It depends on the user.

For every retired tinkerer like yourself just wanting things to work smoothly (a noble goal!), there’s a journalist whose physical safety depends on their data being encrypted and isolated. There’s a developer whose job depends on their code not being snooped on by a rogue browser extension. Wayland’s security model, for all its current NVIDIA woes, is critical for those people.

Linux isn’t just a fun hobbyist OS anymore. It runs critical infrastructure, and people with very serious needs rely on it for their daily desktop. Ubuntu’s “obsession” is a reflection of that immense responsibility.

They’re building a system that’s safe by default for the masses, while still leaving the toolbox open for us old-timers who know how to handle the power tools without losing a finger.

Food for thought!

6 Likes
4

While not enjoying the rough seas, I understand and accept the need to cross the ocean to reach the other side.

However, it would be nice if ALL the toggles for every single “guardrail” were available thru a single GUI offering

  • the on/off toggle

  • a short reference description (for quick correct identification)

  • a mouse-over/click pop-up offering a more expansive description to help remove any ambiguity regarding the choice of, and impact of, enabling the particular selection

  • another mouse-over/click pop-up listing which of the lists explicitly which of the other “toggles” of this GUI are impacted/nuanced by enabling that particular feature toggle

I realize that what I outline above may seem like a nuisance request … but consider the fact that having that “documentation” offered by the pop-ups ensures everyone is on the same page as to what each feature is intended for and the scope of impact thereof.

I offer these comments as food for thought!

:slight_smile:

5

You are not the first to ask. It’s a recurring idea.

It’s open source. Anyone who wants to learn the code can create such a tool.

So far, none of the folks who asked have been willing to put in the effort. If those power-users don’t care enough to follow through, why should anybody else volunteer to do it for them?

6

I would venture to say that those requests are likely not coming from “power Users” (a label which I associate with “Admin-level Users” or professional “software/systems” developers), but from Users who have enough experience to be comfortable, and maybe even adventurous … at what I will call the “non-Admin” Application level activities … to express a desire to “stick their toe in to test the waters” … or crossing-over into active tuning of system internals.

( To clarify my perspective, I don’t see anyone as having mastered Shell programming as an Admin-level User. Although it has far greater reach and capability, in my eyes, Shell programming is akin to Windows BASIC programming; a “simple” tool for personal task automation. )

Such people, and I count myself among them, don’t feel they have enough depth of knowledge … on a sufficiently broad scope … to want to take a chance at delving into those “arcane arts” without having such guardrails in place. For that reason, many candidates, who could potentially do well but for a lack of specific knowledge in some area, choose to step away from the challenge posed … for fear of failure which, given the circumstances, could have destructive implications … which they prefer to NOT expose themselves to.

That being the case, I don’t see myself as being in a position to even start to contemplate where to begin, or which progression to follow, in order to conceptualize, let alone even begin to code for, such a tool as I have proposed in my earlier posting.

If you may have noted from my other postings, where I do feel comfortable, I don’t wait. I dive in and offer tools which, in some cases, were created for the situation at hand, so, I am not reticent to “step up”, but only where I feel I can … and know … that I can contribute.

I am not personally insulted by some of your reply.

However … I do somewhat resent that every time that someone who “knows enough to be dangerous” (not just in this forum but in others as well) … and also cares enough to outline where they detect a precipice they don’t want to fall into … and takes the time to clearly outline what could be done to facilitate the “growth” experience … such as I did earlier … is pushed back in a fashion that leaves the taste of a “veiled rebuke”, rather than take it as a clear … and constructive … first stepping stone in a process … to refine the “feature set specification” for a tool for which, as you yourself stated, seems to have a clear demand as exemplified by

7

I heartily apologize for the unintended rebuke.

And I definitely encourage you to keep exploring.

Over 20 years, I have watched folks wanting “someone else” to develop various ideas for them. Most of those folks were disappointed when they discover that “Free Software” does not mean “Free Software Development.”

The actual pool of volunteer developers (“someone else”) willing to adopt a project is small. Most of those volunteers are already busy with their own projects. Scratching their own itches.

The mismatch between many ideas from a wide audience vs. action from finite volunteer developers is not Ubuntu’s problem to solve.

We welcome folks who want to learn more skills, we welcome folks who want to tinker, and we welcome folks who have the skills to answer questions. The community shares its learned experience (even when it’s bad news) and we do try to help each other.

4 Likes
8

@popey I had a childish (me - not Ian) little run-in with the Ian on here and vowed I’d never return, but I’m like an addict, the notifications pop up in my email feed and here I am again…
Anyway, I agree with you about people who need these security features absolutely depending upon them for their worklife, but as I said in the initial post, there is a ready-made solution for all of them in the server solutions of Linux.
My point is that in order to satisfy that particular group whose need can be met by the server offerings, the whole of the desktop development seems to have been usurped by this obsessive need that works as an obstacle to usability
For 99% of users who are moving to the Linux world from Windows, the whole ecosystem is SO much more secure in that regard that the precipitous rush of badly implemented security measures without the necessary extended period of testing and slowly finalising the end product is totally counter-productive to the stated aims of growing the use of the Linux desktop.

1 Like
9

@ericmarceau Thanks for your input and I agree absolutely with your thoughts.
In particular I am very disturbed by the decision to remove X11 from the boot options of new releases. Many Linux users both new and old are drawn to Linux as a way of preserving perfectly usable older hardware platforms and giving them a new lease of life. This hurried implementation of Wayland as the default without an obvious alternative to X11 in many hardware uses is a very retrograde step, and needs to be reconsidered. Why it was even contemplated before all the issues with Nvidia video cards have been ironed out shows just how out-of-touch the powers that be that make these decisions are.

With regard to this:

However … I do somewhat resent that every time that someone who “knows enough to be dangerous” (not just in this forum but in others as well) … and also cares enough to outline where they detect a precipice they don’t want to fall into … and takes the time to clearly outline what could be done to facilitate the “growth” experience … such as I did earlier … is pushed back in a fashion that leaves the taste of a “veiled rebuke”, rather than take it as a clear … and constructive … first stepping stone in a process … to refine the “feature set specification” for a tool for which, as you yourself stated, seems to have a clear demand as exemplified by

You have clearly exposed a recurring theme from many on here, something I too have experienced myself many times. “veiled rebuke” sums it up perfectly.

10

You have written this opinion before. It’s been read before. You’ve had your say.

Closing, as this topic has devolved into Wayland-bashing and the endless navel-gazing spiral of security vs. usability, with a bit of Moderator-bashing spiced in.

5 Likes