I'm not sure the "big problem" of Windows stemmed exactly from possibility to install third-party apps, and not from poor security defaults which let those apps to mangle everything around without asking for permission, and poor architectural decisions which let some programs to install themselves (aka viruses). Nowadays Windows is much better with this staff than it's used to be, in spite of the fact that (contrary to your statement) installing unsigned software is still as easy as pushing buttons.
To be fair, Linux and friends aren't much better in that regard. Permission management for locally running programs is pretty much poor by default in all major operating systems. SELinux and AppArmor for Linux improve on the situation, but they're usually not the default unless you're using Fedora, and even there, it might need some extra configuration.
I'm looking forward to capability-based systems with microkernels, since they really improve on the situation, but I think it'll take a while until we get some major ones. Maybe Google's Fuchsia will establish itself soon enough, who knows? (We'll also have to see what can be done about hardware security, since any software mitigation could potentially be rendered useless by insecure hardware.)
> To be fair, Linux and friends aren't much better in that regard.
Linux gets there a different way. The standard way to install applications is from the package manager and essentially all of the applications in there are trustworthy (because they're all open source and if they did anything seriously user-hostile, someone would fork it and that version would be the one in the package manager). Meanwhile the package managers do actually add nearly everything that isn't user-hostile, so the need to install anything from another source, while still possible, is rare enough that most people never have to do it.
And binaries downloaded via web browser don't even have the execute bit set by default. You can still do it, but you have to know how, and the people who know enough to know how to do it generally know enough to be suspicious when doing it.
And even then, things typically run as the user rather than root/administrator, so they can't alter the system or anything other than that one user's (presumably backed up) home directory.
Having even more granular permission would be even better, but restricting the harm to one home directory of one user and only in cases of users who are at the same time knowledgeable and stupid has already handled basically the entire problem.
Package managers are exactly the centralized "app store" model, and there have been plenty of periods where users have had to add third party repositories to get basic functionality (DeCSS, video codecs, ZFS, etc).
The difference is that Linux repositories are less noteworthy to attack, have a more distributed culture not ruled by capitulating lawyers, and can actually jurisdiction shop.
The ultimate problem is a lack of a cross-software security model of the OSs, Linux included. User-based isolation is cool and all, but orthogonal to the modern world [0]. For decades we've been continually looking for better ways of isolating local apps, while also rejecting centralized control. We keep looking, while centralization keeps ratcheting.
I'm still hopeful that a well done capability (handle-based) system would go a long way, but not fully solve it. Unfortunately that means shedding off POSIX/LSB rather than duplicating the entire monolithic OS environment for every security context.
[0] Where say even a local LAN IP address is security-critical information!
> Package managers are exactly the centralized "app store" model, and there have been plenty of periods where users have had to add third party repositories to get basic functionality (DeCSS, video codecs, ZFS, etc).
And they still work precisely because the user can do that.
> For decades we've been continually looking for better ways of isolating local apps, while also rejecting centralized control.
The main issue is that there is so little real benefit in it. It's possible to isolate e.g. LibreOffice so that it can't access anything it shouldn't, but in general the authors can be trusted not to be doing anything nefarious to begin with, so what you're really doing is limiting the damage in the event of compromise. In which case you're still pretty screwed, because it inherently needs access to your documents, so the focus has not surprisingly been on preventing compromise rather than mitigating after the fact.
> We keep looking, while centralization keeps ratcheting.
The motivations behind the rise in centralization are authoritarian and pecuniary rather than any legitimate security concern. Trying to prevent it by finding alternative ways to improve security is like trying to repeal the DMCA anti-circumvention rules by finding alternative ways to reduce piracy. They'll never be satisfied because their motivations aren't the stated ones.
> in general the authors can be trusted not to be doing anything nefarious to begin with
It's a dream. Kept alive by a very diligent community, but let's not kid ourselves that it's a very strong assumption.
> In which case you're still pretty screwed, because it inherently needs access to your documents
Access to the specific document you presently want to edit (say through an OS-provided file select dialog or equivalent cli) is much different than unfettered access to all of your files.
> The motivations behind the rise in centralization are authoritarian and pecuniary rather than any legitimate security concern
People do choose say Apple products precisely because of the curated Disneyland App store. Centralizers certainly have their selfish motives, but people are driven into their arms looking for safety. Browsers are used for software distribution precisely because they're a sandbox - there's much less fear of the unknown than running a random exe.
> Access to the specific document you presently want to edit (say through an OS-provided file select dialog or equivalent cli) is much different than unfettered access to all of your files.
This is one thing I like about Android. You can avoid requesting file permissions for your app by using native intents for file access. I think its the same for other stuff, like email. As much as I loathe Googles control over Android, I think this is a good thing.
And they still work precisely because the user can do that.
And you can install an anti-paywall extension in Firefox.
The moment you concede the Linux "well you can work around it" argument is the moment you have to stop arguing on pure absolute principle and start arguing about practicality and the relative difficulty of workarounds.
