Slashdot Mirror

>> It was more carefully planned
Thats just ridiculous. Consider how much effort, (even just in broad brush terms of numbers of engineers, different companies and universities are working on it) hav gone into developing Unix, and are continuously happening on the Linux kernel, compared to NT kernel.

Dave Cutler had previously headed the coding teams for RSX-11 (PDP), and VMS (VAX), before departing DEC with his last team and the PRISM source to build what became NT. Cutler had FAR more experience than any of the architects of free (non-AT&T) UNIX. He easily rivals Ritchie and Thompson in his stature as a father of operating systems.

For a better understanding of DEC, the genesis of NT, and the roles these various people played, I recommend that you read ShowStopper. The planning behind the NT kernel certainly dwarfed the care behind the accretion of Linux.

And yes, the NT kernel appears safer and more secure than Linux, especially as Linus does not focus on security. (I do realize that 119/38 is not 24/26 - but the second figure likely involves userspace, which is not apples-to-apples.

Bah, we'll lump an exploit in IE, Outlook, Office, even Adobe products all in with Windows vulnerabilities. It's not like we're unbiased! *chortles*

I don't know how they compiled the stats but, suffice to say, Windows has come a long ways. I'm truly impressed. I'm not going to switch back to Windows but I'm impressed with their progress. Security was not the reason I left Windows. Collecting telemetry data was not the reason that I left Windows. I left mostly because I prefer Linux. I started in the Unix realm. I poked at Linux when it came out. I poked again in the late 1990s. I kept a partition with Linux installed, pretty much all the time. I moved to Windows in 1999 or so. I stayed there but kept my partition. I went back to Linux in the mid 2000s. I then got back on the Windows bus and stayed there for a while. Over the past few years, I'd been finding myself using it less and less. Finally, I just said to hell with it and got rid of all my installs, deleted TERABYTES of Windows software, and just stopped using it. I may do the same thing shortly only this time moving to BSD land - that will probably wait until I get home.

So, I'm kind of agnostic? It's not like I hate Microsoft. I did let my MSDN subscription lapse. However, there are scads of exploits for Linux - daily. I update daily - sometimes multiple times in a day, and there's almost always something new when I 'sudo apt-get upgrade' or whatnot. (I'm in the Debian camp, for the most part. Specifically, in the Ubuntu family.) I guess, I agree that it is not a very easy comparison.

I remembered what the image looked like (I think someone had linked the image) and I've since (just now) read the article. It's actually pretty good and I'm not going to say that I'm sure that I'm qualified to give an opinion. This looks like a fairly unbiased set of research combined with a fairly decent article - I was able to recognize the image of the graph! >:-)

http://www.gfi.com/blog/most-v...

That's for last year. Grouping all of Windows together seems a bit unfair so they've separated them. They only include the Linux Kernel in one section - they do delve into distro specific vulnerabilities.

It's well worth a read if you get a minute. It's not bad, not bad at all. It almost looks objective.

That's the fun thing about plural words. They can mean anything between 2 and a gazillopetainfinigoogolplex.

For 2014, it seems that despite Microsoft's reputation and much larger marketshare, there were many fewer vulnerabilities in Windows than competing products. (And no, you can't just sum the numbers for different Windows versions, most are the same vulnerabilities that existed across versions.)

How many vulnerabilities is there in Ubuntu 6?

39 total vulnerabilities, 7 high severity, 27 medium severity, 5 low severity.

http://www.gfi.com/blog/most-v...

Debian Sid?

Couldn't find that. It's in NVD though, if you're really interested.

https://nvd.nist.gov/

Windows XP is FIFTEEN YEARS OLD

No it's not. It's still under development, and there is almost nothing left of the codebase from the original XP when you have patched up an XP install.

Otherwise Linux is TWENTYFOUR YEARS OLD, but you know, writing that in all caps as if it means something just seems silly. Because it is.

And hardly any of the Linux vulnerabilities allow a web client attack, like a whole slew of the Windows ones do. Because Linux does not have a web browser with kernel access. Therefore, the low level vulnerabilities in Linux are not like the low level vulnerabilities you are used to.

No. This was not gross negligence. This was not a bug that would affect anyone under conditions remotely close to normal. This is something that is being actively exploited by someone (the criminal in this case) in a way never intended by the programmers. It'd be like suing the people who made the bullets used in the Sandy Hook massacre. Not only that, they probably agreed when they installed the software not to hold the software company responsible for anything. The way the system works, if Microsoft does this enough and demonstrates that they cannot create secure products, the market (cue angel choir) will punish them.

Yeah, for no other browsers have vulnerabilities and exploits..

My university has been targetted too. They create a form on top of a spreadsheet, make it look legitimate because it can be customized and then email it around. http://www.gfi.com/blog/google-docs-phishing/

It gets past a lot of protection layers because Google Docs is trusted/whitelisted by most IPS filter lists.

There will likely be a silent switch or some automated booting switch built in for re-provisioning server systems that need to come back up without user intervention.

However, I'm not sure that this secure boot and signing will be able to completely rule out boot sector viruses. If it can get into memory, it can manipulate about anything after that. I imagine something like this might be adapted. But i'm not a coding guru so I could be wrong. I just don't trust microsoft enough to not open a gaping hole somewhere right after the boot loader.

http://www.gfi.com/blog/how-the-tdl4-rootkit-gets-around-driver-signing-policy-on-a-64-bit-machine/

Mild?" Sure the permissions are relatively mild, like where the Romney app has access to record audio and control the camera. Writing to storage as well.

One auto-update and it can capture anything you do and upload it to the Romney campaign.

Obama's app does not have audio or camera permissions. But it does give you a list of registered voters in the area so you can go hound people into voting for your candidate. It also reads your phone contacts so it can tell if you have a registered voter in your contacts. It can also read your call history, to see if you have called any numbers that match those people in your contacts.

This might as well apply to any mobile app, but since these are getting a lot of attention, it makes sense to call them out directly. Now I dare you to insist that this is no big deal, without resorting to "other apps are worse so it's okay".

Aside from getting more memory I would recommend that you update one of "the most targeted pieces of software" more often then just when YT stops working. There have been so many exploits released for Flash and Adobe released a lot of security updates to address them. http://www.gfi.com/blog/the-most-vulnerable-operating-systems-and-applications-in-2011/

First of all you shouldn't seek a technical solution (alone) for a communication / policy problem. Talk to the employees and establish a resonable policy.

Beyond that, check out if GFI WebMonitor is right for you.

(disclosure: I work for GFI Software, not on that product though.)

Sure you can solve the USB problem with tech, hell you don't gotta even glue the suckers shut. Just use something like this which I'm sure the US Gov can afford to buy from the guy, and have it throw up a red flag when some accesses any PC with a non pre-approved USB device. That is the nice thing about USB, you can write USB HID to do just about anything you want. Just strip the USB HID drivers out for anything other than Keyboard/mouse and have it throw a shitfit if any non-approved device gets plugged in.

Remember folks, we aren't talking about James Bond 007 superspies here, we are talking flunkies. Hell you look at the history of spying during the Cold War and many if not most major spies were just low to mid level flunkies that managed to worm themselves into a position where they had easy access to sensitive data. If that data would have been harder to copy a good amount of that spying never would have happened. I think the bigger problem is you are talking massive orgs with ungodly amounts of crap classified that frankly should have never been, thus making it all, the stuff you need and the stuff you don't, all that much harder to protect. I remember reading somewhere that on average the US gov labels 330 million documents PER YEAR as classified. What is that, something like FIVE libraries of congress? Every single year?

In that situation trying to protect the really important stuff is simply impossible because it is trying to find a single needle in a needle factory. We need to have a stringent review system that tosses all the old classified crap that is no longer needing protection, as well as forces review on the low level crap to see if it is REALLY worth protecting and if not toss it. By "thinning the herd" so to speak one could get a lot smaller pile and put much better security around the pile and thus seriously cut down the risk of leaks. At 300 million plus the odds are you are just gonna cripple the workers from getting anything done because too much of what they need for their jobs will require flaming hoops. Sadly with as big a bloated elephant as the US Gov the odds of any real reform are probably zip. It is just too massive, too bloated, too much bullshit you gotta wade through. But at 330 million plus no wonder there are leaks all over the place, good luck even cataloging all that shit before the next mountain of classified crap comes along!

If the new owners decide to continue the trend of irresponsible behavior that has been the hallmark of SORBS in recent times, at least there's a U.S.-based entity that can be more easily sued by for losses now.

I just went through this process a few months ago, and ended up with GFI Anti-spam/anti-virus for our underworked Exchange 2003 server (about a dozen users). I'm pretty happy with it. It's one of the few that uses a Baysian mail filter (trained by dropping emails into public folders). It also has auto-whitelisting (from outgoing emails), and a lot of other practical features, and just keeps working in the background. And reasonably priced. It's an extra bonus having a mail anti-virus scanner that's different from our desktops. -- http://www.gfi.com/

Works great, even syncs with multiple mail gateways, and you have no client because it uses public folders. http://www.gfi.com/

This product GFI LANGuard PSC http://www.gfi.com/lanpsc/ will let you lock your USB mass storage on a per user basis on WinDoze machines.

We tried it in the demo mode when the administration at a client was freaking out about IPods. We ended up going with a written policy (that actually had enforcement!!!!!) instead of a technology solution!

Slashvertisements - by Google

Removes Spyware - Free
Removes Spyware, Adware & Parasites Stops PopUps & Identity Theft!
www.Adware-Remover.net

Automated C&A Of Systems
Get Free Whitepaper On FISMA Compliance Automation
www.securify.com

Free vulnerability scan
Security Vulnerability scanning & fixing with LANguard!
www.gfi.com

Sounds like what you need is GFI LANguard Portable Storage Control.

Good product...I highly recommend it.

It's not a total solution, but GFI Network Security Scanner (used to be LANGuard) can scan for unauthorized USB devices and fire off an alert if it detect one on a scan. Demo available at http://www.gfi.com/lannetscan/.

try GFI MailEssentials i've been loving this product. free for 30 to 60 days

http://www.gfi.com/mes/

I guess I don't usually associate the term "firewall" with spam filtering. The article only touches on their use of the terminology in the quote that you've selected. Otherwise, it's a general discussion of filtering techniques and the effects of spam on the internet.

If they're maintaining that they filter out spam prior to it hitting the email server, or well before it hits the email client, then they really need to get out more before making the claim that they're the only one to do it. My personal fav these days is GFI MailEssentials, which stops spam at the server level by examining the incoming SMTP traffic.

GFI LanGaurd, a great peice of software to manage all of the machines on your domain. Download a trial here.

GFI LANguard System Integrity Monitor is a utility that provides intrusion detection by checking whether files have been changed, added or deleted on a Windows 2000/NT system. If this happens it will alert the administrator by email. Since hackers need to change certain system files to gain access, this FREEWARE utility provides a great means to further secure any servers that can be attacked.

Maybe this is due to the fact that Linux is used in more "Mission Critical" applications. Therefore, the companies running Linux boxen are going to be more likely to keep their boxen secure and up to date.

For instance, most corporations have went to using Win2k for their desktops, yet it is rare to find a desktop Linux box. The TCO of a desktop is certainly less than that of a web server!!!

I'm going to guess that the lack of detail is intentional...

Of course with a little sleuthing, you can find out they're running IIS...and this page describes themselves as a marketing company (hey, it's the same company that owns TechWeb).

Go a little further and you find they're handing out awards for M$ ... but I think they way their site held up to a good slashdotting shows how good Win2k solutions are...