Slashdot Mirror

even if they encourage you to hide them behind a firewall - a kludge at best

Firewalls are a kludge now? And when you say "encourage", you mean that it blocks them all by default?

Linux has a repository from which to install software, while windows encourages users to download and run arbitrary binaries.

I never said Linux doesnt have any cool features that Windows lacks. Repositories on Windows would be awesome. But we're not exactly talking "system security" any more; we're discussing systems of trust and methods of acquiring executable code. On most desktop linux installs (and many server installs) that I've done, I've had to download a .deb or .rpm file or else install a 3rd party repo for some program that wasnt in the base repos. Thats really not much different than downloading an exe from a known trusted site-- I often download files off of nirsoft.net or sysinternals.com or the major vendor sites (firefox, adobe, google, microsoft), and I dont see it as much different than using a repository (in both situations you have to trust that the vendor's server has not been compromised).

Repos on windows ARE the biggest thing on my wishlist, all that said.

Windows has things like stack randomization and non executable pages, but so does linux and has done for much longer.

DEP was enabled in windows apparently about the same time as it was for Linux. I had thought that ASLR was introduced in Windows first and Linux later, but it seems Linux was first there-- though wikipedia notes it was a "weak form" (not really sure what is meant by that).
Its kind of irrelevant though, Im discussing the status NOW. I think this article puts it well--
"I think the question is far more complex right now actually. For example, what constitutes "Linux" or "Windows"? If we're talking only about the kernel, then they're about the same (both extremely secure). They've certainly made different design decisions, but at the end of the day kernel exploits for either OS are extremely rare."

Take group policy "folder restrictions" for instance, designed to prevent you browsing certain areas of the filesystem (eg the windows dir, or the root of the hd), and sure enough if you type c:\ into explorer you will get an error... But what if you open a subdir (eg browse the temporary internet files dir using the option within the ie settings), and then keep hitting the up option..

Microsoft freely admits that that particular GPO (and others like it) are not security options. If you want security for that, use the NTFS "list directory contents" and "traverse folder" ACL settings. I am not aware of analogues for Linux ext3/4, incidentally.

Linux doesnt have "features" like these because they are pointless, if you want to prevent users from accessing a given area you need to use file permissions.

I think there are some rare use cases for that particular GPO: perhaps you prefer to prevent users from seeing that a particular folder exists or what its contents are, but it is necessary that their account have permissions to access those files (for instance, you dont wish them to be able to see or delete temp files, though it is absolutely necessary that their account be able to read / write / execute data in that folder).. At any rate, NTFS has far more granular ACL controls than ext2/3/4, and can easily do what you talk about. And I wouldnt exactly boast about the lack of GPO support; GPOs are IMO one of the most powerful features of Windows. Being able to deploy a policy that says, for example, deny "execute" permission to any file not in C:\Windows and C:\Program Files, or else to publish a whitelist of executable hashes that are permitted to run, is pretty darn powerful.

My company uses a company called Security Innovation. We have used them several times for various engagements including an embedded system, Unix applications, and our latest Web based interface into the system. Each time they have found some serious security vulnerabilities that our customers would have been extremely alarmed if they had been found by their own pentesting teams (which they use for each release of our product). Highly recommended!

http://www.securityinnovation.com/

FFE4: What kind of credibility do you think you have, being a Microsoft MVP?

The link posted in the story is not correct.

Just click through and don't give them any info. You can still download it.

http://www.securityinnovation.com/reliability.shtm l

Where did you find that information? The PDF at the website seems to be a completely different study.

For SLES 8, all required and recommended security patches were applied to the system. The same criteria was applied for Windows patches. These patches were applied in 1 month increments to the system. On the SuSE side, during the one year period under study, patches were released for the core components from multiple sources spanning package developers, individual contributors in the open source community, individuals and corporations. In this analysis, we only consider those patches issued by the operating system vendor (Novell/SuSE). From an enterprise management standpoint, this is the most common scenario given that the chief benefits of using an enterprise Linux distribution is the compatibility testing done by that Linux vendor on patches and the support extended to administrators. By going outside this channel for patches, both benefits are forfeited. In the period from July 1st, 2004 to June 30th 2005 there were 187 patches that were applied to the system. Of these patches, 13 affected the kernel. While kernel patches did not require an immediate reboot during installation, the majority of them need a system restart to immunize the system against a specific vulnerability. In general, patch application on SuSE proceeded well and most patches installed without error or conflict. Beginning at Milestone 1 however, some upgraded components were out of support from SLES 8 and updates for those components had to be obtained from the package distribution sites. As of Milestone 1, MySQL patches were obtained from the MySQL distribution site and as of milestone 2, glibc and directly related packages were maintained through manually applying SLES 9 patches. 3rd party component installations were performed according to the installation procedures specified by those vendors.

So has anyone allready taken this to the test ?

As long as there is no counterevidence (besides the obvious evidence from everyday use of both OS's), why allready pass a judgement? (Ok, this -is- Slashdot, I'm not -too- new here)

Allthough I find it dubious, to say the least, to have MS funding this research ; I still think that they should at least try to reproduce the results , and investigate what might have been left out (on purpose) to skew the outcome.

Unless you can find fault with the study itself, there is nothing wrong with Microsoft financing studies which show Microsoft in a favorable way as long as the study itelf was legitimate.

...to consider the possibility that if the study was unfavorable to Microsoft's position they would simply have pulled the plug and thrown away the results?

I realize this may be a difficult concept for many /.'ers to grasp but give it a shot.

The results of the research show that both Linux-based deployments contained more total security vulnerabilities and more "days of risk"-- the amount of time elapsed between public disclosure of a vulnerability and the issuance of a potential fix by a vendor--per vulnerability. The report also includes a separate, step-by-step description of the repeatable methodology, so that others can duplicated and validate the results.

Windows vs. Linux Web Server Security Research Study

the fact that 5 lines of TEXT can compromise the Diebold system is just plain sick!! Kudos to Herbert Thompson at Security Innovation for finding the hack... heh heh