For this article, it is accepted that in today’s real world, there is little to suggest that worm writers would or could create the same degree of havoc on Linux as they have for Windows. However, that does not mean that Linux is impermeable to attack by the same kind of malicious, worm-writer-minded efforts that plague Windows. So what are the real vulnerabilities of the Linux operating system?
What are the real vulnerabilities of Linux?
About The Author
Eugenia Loli
Ex-programmer, ex-editor in chief at OSNews.com, now a visual artist/filmmaker.
Follow me on Twitter @EugeniaLoli
Junior sysadmin installing Linux and not patching it.
I would have to say that uneducated DE zealots are Linux largest downfall and licensing is its greatest vulnerability, probably not the type of vulnerability being asked for.
a) users don’t run as root (ala Administrator in Windows) because of better design not from just the OS but from software authors
b) less random services running as privileged users: see RPC and that fiasco called Blaster
c) security has always been a focus, unlike Microsoft’s afterthought ways with security
d) two words: Internet Explorer
e) most software is provided for you through distributions, rather than downloading random crap on the Internet
So there’s you 5 very good, solid reasons why Linux would be more immune to worms and viruses. I’ll try to think of more upon your request.
Your both right and wrong. Right in that unless we experiment we have no idea what the security situation would be if 90% of normal users ran linux.
Wrong because you fail to take into account. Design. When something is designed a certain way then it is better than something that wasn’t designed properly. I was barely connected to the internet long enough to activate windows. Upon first start up my Internet Explorer was infected with Elite Bar. That is a design issue. No OS should boot with all these services on by default(grant it supposedly is better with sp2 but not many people have sp2 cds. My install cd is sp1a and no new computers bought by people are patched before being loaded)
Whats worse is the designing of putting all settings in a registry. No thank you. I believe the text file settings with only root access being able to change them in /etc is a way better design idea. Especially since you can understand what the hell is going on.
Not being able to delete Internet Explorer (IEXPLORER.EXE) is a design issue. You should be able to get rid of the damn buggy broswer without it complaining.
Having Admistrator being the default user for OEM pcs. Is a design Issue.
Grant it if the user is stupid then yes no system is safe, but hell they need to think about designing a better os.
I’d like to add:
f) Linux does not have executables.
Is it some twisted humour that i didn’t get or you seriously think Linux doesn’t have executables?
Well in the sense that you’re talking about…that’s not a good thing for user. THink if car manufacruters made th driver spin around and clcik their heels 3 times before being allowed to open the door
>>f) Linux does not have executables.
And your point is?
If there is people trying to implement a worm, I dont think not having executables is an obstacle. They will figure that out.
I have always said how good Linux is. But I would really would like to be the #1 OS so this worm-genius-minds start attacking it like crazy. Hopefully it will silence for ever the popularity issue (Yeah all windows fans). Hopefully, Linux will end on top (I guess :-)).
Josh: It’s IEXPLORE.EXE 😉
And while it isn’t good that OEM machines ship with the default user as Administrator, what’s the alternative? Windows has no sane way of running anything with increased privileges (ala su/sudo) so if, say, Dell started selling machines with restricted users as default all they’d do is wear out their tech support department.
The only practical way to alter _anything_ in Control Panel is to log off and back on again. There is the runas command, but I don’t have a clue where those control panel apps live to use it – which is a big step up on most users who couldn’t cope with the command prompt in the first place.
Basically… don’t blame the OEM’s, it’s not their fault.
rk: As a charitable suggestion, did you intend that on *nix systems you have to grant execute permission to a file before it can execute?
Otherwise, they’re called binaries, but they’re still there – look in /bin, there are heaps of “executables”.
like SELinux, grsecurity, lids and owl.
isn’t they’ll decrease worms danger/damage/spread?
A good majority of Linux users are very knowledgable of their system and howto control it. Further more GNU/Linux provides an excellent framework to administrate or provide a secure by default environment. Oh did I mention there are a large majority of security experts in the Linux community?
Also Microsoft usually pays lip service to security and leaves the front door open.
Back in the RedHat 5 and 6 days, default installs would be owned in no time because they started so many services up. I don’t how Fedora/Redhat fares these days because I haven’t run RedHat in years.
…comes basically fromthe same place as in case of Win variants: from between the screen and the chair.
Like many others, I’ve also seen improperly configured boxes. These days when someone installs some linux and doesnt’ use basic tools like xinetd, pam.d, iptables, acl’s (and these are just the tip of the iceberg from the many fairly easy protection possibilities) cannot be reasonably called an admin or anything close to it. But only the usage of these and not using root privileges unnecessarily can provide such level of protection which Windows will never be able to do (well, without hardware firewalls and robust third party software protection, but with all these there is also one big leak: it’s architecture).
Actually a runas is just like sudo, but the average windows user isnt going to know when or how to do it, just as the average windows user would not know how to su on a linux box. I think the thing is that you cant expect everyone to have the ability to use a secure OS (or use an OS in a secure way). Secure typically means steep learning curve. Usable typically means less secure. So…we can put all the windows users on linux and then ask ourselves why internet usage has went down 90% or we can give them something they can us, in a usable manner (running as admin) and let the money flow. OSS software makes money off support. The problem with MS is not them making money of their OS, but that people still have a need to pay for support with an MS product (although I dont ever remember paying a cent for any MS related support). I would have to say that third party companies (ma pa computer shops, best buys, companies like that) make more money off MS related support than MS. Either way, run linux with a firewall enabled and run SP2 with the firewall enabled, and your pretty much safe from the outside world…not the inside world (which conist of a “user”)
More reason to produce more security default settings!
I want to see iptables enabled by default with NAT. Little or no services exposed to the outside world. SELinux getting unrolled. Come on lets take the gloves off and make the security rock solid!
“f) Linux does not have executables.”
Dude, it is just like any unix. Linux does have executable files. Unlike DOS and Windows they just don’t have a .exe on them.
Man chmod sometimes and look at the section covering the x flag. You will find that the X flag means a file is a executable or access if a directory.
This just puts a extra step in the way of some one trying to exploit a mail client to get some one to run a file. Still possible, but just one extra step to over come.
i like the idea on OSX to don’t have any root with the installation, admin has the possibility to create it if he need it but has far less power than root himself.
why is it not like that with linux, or other BSD ?
i don’t know if OSX is really more secure but at least it SEAMS more secure than my linux box.
Wrong because you fail to take into account. Design. When something is designed a certain way then it is better than something that wasn’t designed properly. I was barely connected to the internet long enough to activate windows. Upon first start up my Internet Explorer was infected with Elite Bar.
So, basically, you connected your unpatched system to a network known to be rife with automated network scanner-exploiters without using a firewall, logged in as Administrator and proceeded to browse to a dodgy website that infected your known-to-be-vulnerable browser ?
That’s not a design issue, it’s 100% PEBKAC. It was completely avoidable using nothing more than the included software and a bit of common sense.
No OS should boot with all these services on by default(grant it supposedly is better with sp2 but not many people have sp2 cds. My install cd is sp1a and no new computers bought by people are patched before being loaded)
All new machines should have been shipping with SP2 for some time now – if they haven’t it’s the distributors fault.
Whats worse is the designing of putting all settings in a registry. No thank you.
Difference to /etc being mostly semantics, mind you.
I believe the text file settings with only root access being able to change them in /etc is a way better design idea.
The registry has *vastly* more fine-grained permissions than the contents of /etc.
Especially since you can understand what the hell is going on.
The registry is no less understandable than /etc to the layman.
Note also that manual fiddling in the registry is highly unusual, whereas manual fiddling in /etc is relatively common.
Not being able to delete Internet Explorer (IEXPLORER.EXE) is a design issue. You should be able to get rid of the damn buggy broswer without it complaining.
It’s trivial to delete iexplore.exe. Select file, hit delete.
Having Admistrator being the default user for OEM pcs. Is a design Issue.
No, it’s a configuration issue.
Grant it if the user is stupid then yes no system is safe, but hell they need to think about designing a better os.
You need to think about the difference between *design* (which lays down the fundamental paramaters of operation) and *default configuration* (which defines how the system is setup out of the box).
For example: being multiuser is a *design* feature. Setting up the first registered user as an Administrator is a *configuration* setting.
I think a lot of the Zealotry comes when people start to compare Linux security against Windows security. The problem is that these are not in the same ballpark. Linux has more in common with MacOSX and other UNIX systems security than it ever will have with Windows security.
So now as soon as someone starts saying Linux is insecure in this or that way people make this mental comparison to Windows insecurities but the truth of the matter is that Windows is light years ahead in insecurity. Even if Linux had 90% of the desktop we would not see the same problems as we see with Windows. And because Linux people “know” this they complain and stick their heads in the sand saying Linux is not insecure.
What really should be said is:
Linux is far more secure than Windows and always will be (unless Microsoft changes things), but this does not mean that Linux is secure, and Linux people should take security seriously because security always is a problem.
OpenBSD is secure
—->[]
Linux is far more secure than Windows and always will be (unless Microsoft changes things) […]
Change things like what ?
One of the great differences is the open source, and the comunity that exitst around Linux. Young kids comes to Windows and is curious about what goes on inside – pokes and prods some – contacts others reads about viruses and worms and is soon seeing what he can do. Young Kids comes to Linux easily looks under the hood – contacts others – the os comunity – gets a “sure look around – I am working on this or that neat project – wanta help?” response. Soon the kid is seeing what he can do – on some OS project.
My guess is that Linux will generate far fewer Virus and worm writers and more people working to block them.
Having Admistrator being the default user for OEM pcs. Is a design Issue.
drsmithy:No, it’s a configuration issue.
If it would be a configuration issue if you would issue an unattended install on 1000 PC’s .The desktop user hasn’t control over the default state at the initial install which is determined at design time like which services should run as default , which accounts should been made and functional and with what credentials etc.Not all users have the desire to configure and or harden the OS.There are a lot of things that shouldn’t have to run in its default state on many OS-ses.
For example: being multiuser is a *design* feature. Setting up the first registered user as an Administrator is a *configuration* setting.
Doesn’t matter how you define it fact is that you can’t control it until the system is installed altogether,it’s been done for you wether you like it or not,unless you perform an unattended install from a spare PC.
The registry has *vastly* more fine-grained permissions than the contents of /etc.
Not only the registry but the whole file system.Major drawback is that windows relies to much on executable file formats.Whereas Linux and all other unixes,bsd’s etc you can name a file anything you like it doesn’t realy matter.The problem isn’t that windows can’t be configured to make it a bit harder to target but there’s more you have to change in the default state to get more “security”.Linux should have
more then (owner/group/world)+(read/write/execute) to control what where and how is accessed in the file system.
Like SeLinux,MAC,RSBAC,LOMAC,DS9,OpenWall,Grsecurity,CAP,xattr,PAX or whatever combination in it’s default state.This for a good admin not an issue to implement and could make an major difference for a server system that you install once and for the rest only manage.For a average end-user desktop system it’s hard to predict all the possible problems side effects the above implementations would generate ,last but not least what policy would be implemented for the default out of the box phase?How easy is it to configure them..?
Anyway Linux and all othe UNIX derived have far more *better* ways to implement security features or harden the system,if not easy to configure.It’s only a matter of time till they have matured enough or have become defacto standards and are as easy to configure as setting the overall system security to paranoid or high in a configuration panel,like Mandrake 10.1 where the paranoid setting will have the effect that the user has only (write) access to his own /home section and for the rest can run firefox browser and other executables from his /home/<user> part.For the rest he has to do it with what the admin has installed.Along with the few services that run, this is a good secure state for the average desktop system.The ball has a clear direction and is rolling.
Change things like what ?
Can you disable the RPC system ? Can you encrypt the paging file system so you don’t have to wait for it to be cleared before the system finally halts.It’s perfectly possible to run
mirc irc-chat from a encrypted folder on windows.It’s furthermore possible to check the option that every new instance in (only) that particular folder gets automatically encrypted as well, or inherits the acl settings from the parent, or not.
the squishy thing in between the monitor and the chair.
i like the idea on OSX to don’t have any root with the installation, admin has the possibility to create it if he need it but has far less power than root himself.
why is it not like that with linux, or other BSD ?
Ubuntu does this as well.
“So…we can put all the windows users on linux and then ask ourselves why internet usage has went down 90%”
it would not drop 90% as 90% of the net traffic is mail and web, and those you can do nicely without being either admin or root.
allso, to tobaccofarm that commented about acl over the unix rwx style. we are talking home user here, and if they are allready confused as to how you save a document then they will trash the computer if they have to think about acl. in unix its simple, you have read, write and execute access for user, group and others, this means that all info can be read useing “ls -l” (or put the filebrowers into details mode) and look at the entry for every file and directory. with acls the way its in windows you have to rightclick on a item, check the big list of setting (that include combos like read&execute, fullcontrol and whats not) and then open a second one for a diffrent part of the same system. then you have to keep in mind if the setting are inherited or not and a whole lot of other factors. while this fine grained control is useful in a corp network its overkill for a home user. a home user will have a easyer time understanding the fact that of the other section of the rwx info on a dir is set to +x then anyone can get in, if its set +x on the group then everyone in the group can get in and if +x for the owner then the owner can get in. diffrent enviroments, diffrent requirements. and linux have the ability to have more finegrained acl systems pluged in if needed. any corp system that would require it should have a admin that knows how.
this is why linux is based (in concept) on a os from the early 80’s, the system works and its simple to use. want to hide a file, put a . at the start of the name. want to share control over a dir with other users? set up a group for them and then use chgrp to set that group on the dir and chmod g+x to give them access. clean, simple and i belive that even my father would be able to understand it. and all the info fits on one screen
If it would be a configuration issue if you would issue an unattended install on 1000 PC’s.
Sorry, I can’t parse that.
The desktop user hasn’t control over the default state at the initial install which is determined at design time like which services should run as default , which accounts should been made and functional and with what credentials etc.
These are not design issues. Note that a design issue is something that can’t be changed. You can’t make Windows 95 multiuser, for example.
There are a lot of things that shouldn’t have to run in its default state on many OS-ses.
No argument there, but if you’re going to talk about *design*, please don’t use examples that are *configuration*.
Just because the user can’t change a default setting, doesn’t mean there’s a design problem, it just means there isn’t a way to change the default setting. There *is* a difference.
Doesn’t matter how you define it fact is that you can’t control it until the system is installed altogether,it’s been done for you wether you like it or not,unless you perform an unattended install from a spare PC.
Yes, it does. Again, if it were a *design* issue the user would *have* to run as Administrator, rather than being able to spend 30 seconds configuring a regular user.
Major drawback is that windows relies to much on executable file formats.Whereas Linux and all other unixes,bsd’s etc you can name a file anything you like it doesn’t realy matter.
The way Windows treats 99.9% of filetypes is no different to the way Linux, Freebsd, etc running something like KDE or GNOME handles them – when the user double clicks a file the shell starts up a handler program and passes the file as an argument.
The glaring difference is .exe and .com files, where arbitrary binary code can be executed purely because of a file extension. Certainly this is an issue, but an “executable” file permission also exists in Windows, so it’s relatively easy to circumvent in the future.
The problem isn’t that windows can’t be configured to make it a bit harder to target but there’s more you have to change in the default state to get more “security”.
I agree the default configuration should be locked down more by default. SP2 helps this somewhat. Hopefully LOnghorn will make it even better.
However, it’s not a _design_ issue.
Can you disable the RPC system ?
I don’t believe so.
Can you encrypt the paging file system so you don’t have to wait for it to be cleared before the system finally halts.
Put it onto an encrypted drive.
It’s a well known fact that a system can’t be extremely secure and at the same time maximize convenience. You have to do a tradeoff, which is about the first thing you learn in any security course. (I’m not an expert, but I did take a basic course at the Uni)
In my eyes, Microsoft make their tradeoffs too much in favour of convenience. I think it would be a good idea for them to make it impossible to login as Administrator, and have the system automatically run control panels with runas. A box would pop up, asking for the Admin password when needed. How to run third party executables (such as software installers) as Admin might be a greater challenge, though. The system could perhaps recognize install wizards, or one could do away with them all together and require all apps to be distributed as packages that install with a tool provided by the system.
to tobaccofarm that commented about acl over the unix rwx style. we are talking home user here, and if they are allready confused as to how you save a document then they will trash the computer if they have to think about acl.
while this fine grained control is useful in a corp network its overkill for a home user
Why can’t we have both? A good simple working default state and the possibillity for the professionals or enthusiast to fine grain the settings.I mentioned Mandrake (msec,BSD securelevel?)as an example not as a publicity stunt but just to make my point clear that it’s perfectly feasonable to get a both usable and secure acl setting (One click setting to high or paranoid) that the user doesn’t have to know about because we know it works.However it isn’t all sunshine with Mandrake , it too has its minor drawbacks ,they got this right though.Perhaps in a later stadium it’s worth or possible to add SeLinux,CAP,RSBAC, or whatever mandatory access control system to reach an even greater security level as far as the file system is concerned.The way OpenBSD,Adamantix,Trusted Solaris,Trusted Debian makes priorities could have some more reflection on the rest especially Linux.The focus could be less on quantiy and more on security / quality,working hardware.A good implemented GUI can benefit without being in the way of more advanced vi editing of config files or custom scripts as long the world underneath is still accessible.Plus the option to install nothing X related leaving the security frame still funcioning and some extra features that would break X but can be used now because its a server install.
Worth my $100
Linux is one of the most secure OS but if you make it secure.how and why?one should use kernel patches and recompile your own kernel with i.e Grsecurity,pax security or even by instaling Bastille Linux.as we know many distros allow as defaul after installation.echo request and syn cookies,accept redirects,keep allive time too high,accept timestamps, yes I am talking about the /proc/sys —>sysctl.conf.an for whats sake ssh,sendmail or exim4,inetd,samba are enabled as default right after the installation?well,for me and for you it is easy to stop and disable those sevices when next reboot if I dont need and we know how to configure the firewall.how about newbies?they look for and read and learn.right?nope.those services option must leave to the users,if they need then they enable.default should be disabled when install.I have tested many distros after installation with default configuration in xxx.pcflank.com/exploit tests.yeah those exploits are for windoze but even so the Linux distro which you fresh install with default configuration fails there.I dont want wont to write the exploits or tools name publicly!testing is free!
“Can you disable the RPC system ?”
yes, im not sure there exists any mainstream operating system that doesnt include this as an option honestly.
“Can you encrypt the paging file system so you don’t have to wait for it to be cleared before the system finally halts”
yes, the swap partition can even be encrypted using a randomly generated key at startup (with a new random key everytime the system boots). i can even encrypt the entire root partition on a linux box if i do it the right way and then noone will get my data.
“It’s perfectly possible to run
mirc irc-chat from a encrypted folder on windows.”
right now linux doesnt really have encrypted folders in the same sense that windows does, however they can be equally as secure or not secure depending upon specific method of implimentation and execution.
“It’s furthermore possible to check the option that every new instance in (only) that particular folder gets automatically encrypted as well, or inherits the acl settings from the parent, or not.”
the linux way of doing permissions is slighly different than the windows way, so these dont compare 1 to 1.
i have one to fire back to you, do you have a fine grained firewall included in windows that is customizable to the point that if you wanted to you could have it only allow web surfing on the 3rd tuesday of every other month between the hours of 8am and 5pm? not without installing 3rd party software. the best firewall option for windows machines without using 3rd party software is routing and remote access (found in 2k and 2k3 server) but they still dont allow you the fine grained control that iptables on linux and ipf/pf on bsd give you. xpsp2 firewall is probably the nicest home user firewall from an ease of use vs protection level standpoint but for those of us who are advanced users it just isnt quite up to par for what we want.
This seems just like a puff peice for all the people who know what they are doing. It says don’t be a newbie and stupid when installing a system. It is just put there to say Linux is secure if you aren’t a total moron, just like any other system. It doesn’t actually get into any problems with Linux.
like SELinux, grsecurity, lids and owl.
isn’t they’ll decrease worms danger/damage/spread?
While they can thwart worms or script kiddies as well as agressive attackers, the real benifit is in raising the bar on security over all.
These security extentions (SELinux is built in to the default kernel) implement various levels and types of access restrictions and/or process isolation. Removing the all-powerful superuser access rights (typically given to root) plus process and resource isolation are two of the most important features.
Having these features is becoming a real necessity…though try telling that to people who still run systems with browser components built-in to the core operating system and it’s a hard sell; either they think it’s a Linux-only failure or that we’re being too paranoid. If only it were that were true!
“Can you disable the RPC system ?”
yes, im not sure there exists any mainstream operating system that doesnt include this as an option honestly.
Windows XP Home. That’s one reason the firewall in SP2 was so important. You have to enable a firewall to block the port it listens on; you can’t disable it. (Very annoying.)
I ~believe~ that previous versions in the Windows NT series also enabled RPC and didn’t allow you to disable it…though I can’t remember for certian.
The system could perhaps recognize install wizards, or one could do away with them all together and require all apps to be distributed as packages that install with a tool provided by the system.
Properly written MSI installers have been doing this for years. They simply prompt for a username and password for an account with high enough privileges to install.
The facility already exists and has for years. As usual, the problem lies with getting software developers to use the tools available to them.
i have one to fire back to you, do you have a fine grained firewall included in windows that is customizable to the point that if you wanted to you could have it only allow web surfing on the 3rd tuesday of every other month between the hours of 8am and 5pm? not without installing 3rd party software. the best firewall option for windows machines without using 3rd party software is routing and remote access (found in 2k and 2k3 server) but they still dont allow you the fine grained control that iptables on linux and ipf/pf on bsd give you. xpsp2 firewall is probably the nicest home user firewall from an ease of use vs protection level standpoint but for those of us who are advanced users it just isnt quite up to par for what we want.
Nor is it meant to be anything more than a basic tool. Nor does it need to be for the 99% of the market it aims at.
The true hypocrisy of the position people like you take is that you are first to criticise Microsoft for trying to drive competitors out of business, yet also criticise them for not including fully-functional, commercial-grade toolsets with their OS. Make your fucking mind up.
Having these features is becoming a real necessity…though try telling that to people who still run systems with browser components built-in to the core operating system and it’s a hard sell; either they think it’s a Linux-only failure or that we’re being too paranoid.
Yeah, you try telling people IE’s “integration” into the Windows shell is functionally no different to KDE’s khtml, and they just won’t listen either.
Yeah, you try telling people IE’s “integration” into the Windows shell is functionally no different to KDE’s khtml, and they just won’t listen either.
At least you have the choice to install and use Fvwm2 or Windowmaker and a couple more and not KDE whereas you have only the same windows GUI implementation over and over again.
Although i like KDE and don’t see what is the problem if you have the right acl settings , most things run with user credentials anyway.
(In typical configurations)
* Can users run arbitrary executable code from untrusted sources ?
– Yes
* Can untrusted sources push arbitrary code to the user via typical tools like a web browser ?
– Yes
* Can that code make network connections and attempt to propogate ?
– Yes
* Can that code scan the system for email addresses and automatically email itself to those addresses ?
– Yes
* Can that code start a service listening on the network to allow further intrusions into the system ?
– Yes
* Can that code use simple attacks like prompting the user to raise privileges ?
– Yes
* Does the OS have a history of local privilege-raising exploits ?
– Yes
* Do typical OS network services have a history of remotely executable exploits ?
– Yes
At least you have the choice to install and use Fvwm2 or Windowmaker and a couple more and not KDE whereas you have only the same windows GUI implementation over and over again.
True enough, but that hardly makes for a fair comparison feature-wise, does it ?
Not to mention replacement shells for Windows like Litestep.
Although i like KDE and don’t see what is the problem if you have the right acl settings , most things run with user credentials anyway.
As they do in Windows if you run as a regular user.
For some reason – be it either stupidity, deliberate ignorance or just simply trolling – people like to attribute mystical qualities to IE’s “integration”. Like saying it’s part of the kernel, or that it bypasses OS security systems, or that it always runs in an Administrator context. They do this because – again either due to stupidity, deliberate ignorance or to troll – they read the “OS” part of “OS integration” as “kernel”, missing the point that “OS” is a marketing term in this context and encompasses the entire Windows product, from kernel to calculator applet.
IE’s integration is no different to the similar browser “integration” in other environments. It’s simply a reusable system library (that runs under the context of the current user) that happens to be heavily utilised by the default Windows shell. No different to WebCore on OS X, or khtml under KDE. It’s not part of the kernel. It doesn’t run with elevated privileges. It doesn’t magically fire up in the background at 3am, phone home to Microsoft, seduce your daughter and mess up your house.
The thing that many people probably don’t take into account is that one day Linux might be very famous and widely used, and if that day comes, many users will still be like the ones in windows: don’t care about what their OS does, how it is installed etc. They wont mind entering as root or installing this or that. Granted that WindowsXP is more easy for these folks to mess with their own OS, but in Linux with the same users, it will prevail. Most people don’t care about what they install, they just ask a friend to do the dirty laundry (aka: please Fred, can you remove all my spyware? Damn computers, how it got there??)
Oh well…
My main point was that Microsoft seems to rate convenience above security. They should realize that they need to do the tradeoff differently.
About getting developers to distribute their programs the way they should: if logging in as Administrator was not an option, they would be forced to use cooperative install methods.
“Nor is it meant to be anything more than a basic tool. Nor does it need to be for the 99% of the market it aims at.”
i think you should reread what i wrote, notice how i said “xpsp2 firewall is probably the nicest home user firewall from an ease of use vs protection level standpoint”. this means that i agree it is fine for 99%, just that the other 1% (myself included) like more fine grained control.
“The true hypocrisy of the position people like you take is that you are first to criticise Microsoft for trying to drive competitors out of business, yet also criticise them for not including fully-functional, commercial-grade toolsets with their OS. Make your fucking mind up.”
more power to them integrating everything they want to, it would certainly make installing machines easier. the linux distro i use has it all integrated in the install if i want to install it. my issues with microsoft dont stem from integration as much as the oem deals they make. i cant blame them, they are a company out to make a profit, but i dont have to use their product on my personal system either.
by the way, i do expect more functionality from a server out of the box in terms of fine grained firewalling. desktop? not so much, but server… definately.
microsofts way of integrating and the linux way of integrating are quite different.
I don’t see much of a benefit of fine-grained ACL access in the registry, personally.
And no, the registry and /etc have a lot of differences… much more than semantics. I can grep my configuration in a couple seconds to find something I need. I can rm -rf some software settings and be pretty sure they’re not lurking anywhere else. They’re normally deleted when I uninstall packages, anyway (gotta love the purge option with dpkg). Have you tried searching through the registry before to find a certain key? It takes years. Software has bit upchuck and spreads itself all in there. It’s just a horrid mess.
Seconds, about the run-as in Windows. Yes, it works… sometimes. Other times not. A good example I remember at work was in the control panel. I couldn’t run-as in the control panel to add users.
…but as I have said many times on osnew’s comment section. Linux is *NOT* a secure OS.
* Linux has more bugs per lines of code
* Linux has more bloat and unnecessary complexity than Windows.
* Just because the source is open doesn’t mean it is safe.
Linux users have a false sense of security with their OS.
Suppose every desktop machine in the World was a linux machine. Do you really think the virus writers will just turn off the power switch and say “well that’s it! We we can’t do anything now!”
Wake up!
Linux is far more secure than Windows and always will be (unless Microsoft changes things) […]
Change things like what ?
More rigorously use of TCPA. E.g. make it impossible to run software not digitally signed by Microsoft, or view content not signed by MPAA or RIA. Make sure that documents created by unlicenced copies of software can’t be opened. Make sure that all software calls home to Microsoft to make sure the licence is valid and if it isn’t delete the software and whatever files created by the unlicenced software.
All things well in the line with the new way security thinking at Microsoft.
Of course it gets moderated it’s a straight up lie.
You are just to ignorant to realize it.
* Linux has more bugs per lines of code
Prove it, considering a new way of taking complete control over windows is found weekly, compared to linux which gets patched in days, and within a week is out to every distributor.
* Linux has more bloat and unnecessary complexity than Windows.
Linux can have as much or as little bloat as you want. Yoiu want a full GUI, that does everything for you then you pay for the performace penalty
* Just because the source is open doesn’t mean it is safe.
Apache, owns 67% of web server market and propgates less viruses than ALL of IIS.
Linux users have a false sense of security with their OS.
Windows users have no sense of security anyway. So what would they know about security??
When was the last time there was a major internet slowdown due to a linux worm? Heck How many Apache worms have there been total and Apache has 67% of the web server market. The facts say something different than Microsoft marketing.
Why do we keep arguing about whose house has better locks, while the thieves run rampant on the streets?
“…but as I have said many times on osnew’s comment section. Linux is *NOT* a secure OS.”
Reformulate, Linux is not a secure OS unless you turn on SELinux and configure a resonably good security policy. Most Linux distros don’t do this by default. Fedora Core 3 have started to enable SELinux by default. Unfortunately the default policy is targeted at servers. To the expected userbase of Fedora it would probably would have made more sense to secure the desktop. E.g. make sandboxes for webbrowsers and e-mail clients. Nothing stops you from making such a policy if you have the knowledge to do so. Unfortunately most Linux users don’t.
“* Linux has more bugs per lines of code”
More bugs per lines of code than what? Microsoft? FreeBSD?
“* Linux has more bloat and unnecessary complexity than Windows.
”
Sure, most Linux distros have a lot of bloat. E.g. they comes
with e-mail servers, database servers, office software, paint-programs,… while windows is just a bare bones OS.
Unfortunately, many windows users tend to like this kind of bloat and install MS-Exchange, MS-SQL-Server and MS-Office. By doing so they get even more bloat and complexity than what you get with Linux.
“* Just because the source is open doesn’t mean it is safe.
Linux users have a false sense of security with their OS.
Suppose every desktop machine in the World was a linux machine. Do you really think the virus writers will just turn off the power switch and say “well that’s it! We we can’t do anything now!
Wake up! ”
To some extent you are right. A wake up call is needed.
But at the same time Linux is not an OS it is a kernel.
There are lots of distros of GNU/Linux that are more or less secure. If you look at the various you would find some that satisfy common criteria at EAL-4 (that’s better than Trusted Solaris) to some that are on the same level as Microsoft.
Provided you have a decent SELinux policy, it is very hard for malware writers to do any harm. E.g. its quite possible to prevent any user including root to run files touched by your webbrowser or your e-mail client. It is possible to prevent any user from modifying programs and libs. This is a level of security that is unheard of in the Windows world.
It is already there in all modern Linux distros, the only thing needed is for people to start using it.
Here, Linux developers could help in creating better tools for manageing SELinux policys.
Seems many don’t know the difference and can’t grasp the concept that a lot of people want features. What part of this so complicated?
Don’t you people ever grow tired of repeating the same old arguments back and forth? Once you get the cliche arguments thrown at you from the opposite side you throw another cliche back at them.
And, if you run out on arguments you can throw the Apache-argument at them, maybe they haven’t heard it a zillion times before? If you’re on the other side you might want to throw in the “Yeah but just because it’s open source doesn’t mean it’s safer because… well.. it just isn’t. It says so on the GetTheFacts-site”-argument.
Sorry. Grumpy mood today.
Unlike closed operating systems, the amount of developers go hand-by-hand with the amount of users in the world of Linux. Thus more users will not only mean more 3/1L H4XX0Rs and viruses, but better security as well.
because we can’t do anything about the thieves, and locks are *cool*.
Actually Windows (NT line) has one big design issue – backwards compatibility. This causes most configuration issues, like running as Administrator by default etc.
Probably it was big [marketing] dilemma for Microsoft – to configure XP default [home] installation compatible with legacy (or just any) apps (granting them access to entire system) or configure it more secure, but less compatible (like happens while running in User access rights). We all know what they chose – I think this was right decision then. Internet has no analogies from past – all trends (like last years windows attacking boom) can not easily predicted.
They could drop W9x line many years ago, they could drop all apps, not behaving according to their guidelines (very clear directions, where to put various kind of files, registry keys; how to deal with access rights etc) – they would sink into all kind of compatibilty and support problems.
Linux doesn’t have this kind of problems – necessity to be 99.99% compatible with previuos unsecure single-user design (and applications, using previuos OS). Moreover, sometimes Linux doesn’t need even be compatible with previous version, not talking about different distros
The second big Windows design issue is creating homeuser OS from server OS. Yes, I consider this design issue – server and home environments are totally different, why should same concept and design work for both?
I think this may became problem for Linux too. Linux is not designed for stupid home user (IMHO). To making things easy for everyone Linux promoters may (and probably will) make decisions, starting to kill security in favour of market share.
right now linux doesnt really have encrypted folders in the same sense that windows does, however they can be equally as secure or not secure depending upon specific method of implimentation and execution.
Luckily not, because ‘encrypted folders’ is flawed by design. They can be roughly equally secure, but the *NIX solutions have more potential because passwords can be unrelated to unencrypted-on-drive passwords such as the ones in the shadow file.
HI GUYS!
i am one of the many user converted to unix/linux system and believe me…many more will follow! itś just the begining….
hahahahaHAHAHAHAHAH!!!!!!
really guys…just read the IT news.
🙂
anyway what is that OS that everybody call window$????
Buaaaaahahahaha…too much for me!
😉
Free your mind!
1- Not patching machines
2- unused user’s
3- bad configuration
4- Using Linux with the same style of Windows, NETX, NEXT, NEXT.
Look, the “Linux is safer only because it’s rare” argument is
a load of crap. I’ve raised the following point before and I’ll do it ONE LAST TIME:
Regardless of it’s market share, Linux has MINDshare and the full attention of M$. With thousands of developers on staff and HUNDREDS of thousands of loyal devs around the world, M$ easily has the resources to probe Linux for security weaknesses and the dollars to offer a bounty for a proof-of-concept worm/trojan/virus/whatever.
Easier still, the source is fully open and widely available.
So, in effect, Tux has thrown down the gauntlet from day 1 –
crack me if you can.
It’s a testament to the Unix design that Linux emulates that
it’s so difficult to assault despite laying bare all it’s secrets
Instead, M$ relies on Ballmer’s blustering.
Easier still, the source is fully open and widely available.
So, in effect, Tux has thrown down the gauntlet from day 1 –
crack me if you can.
The availability of the code is not so much help to a cracker as one would expect. The typical cracker would probably use a debugger and try to catch buffer overflows to find whatever holes there are. That can be done without access to the code. Most cracker would probably think that looking at the code would be a waste of time.
The code is primarily of use to people who wants to fix the secruity holes not so much to the people who wants to exploit them.
Who want tohack linux?
cross-browser / cross-platform spoof attacks also.