Slashdot Mirror
Windows vs Linux On Security
e8johan writes "NewsFactor is running an article asking whether Linux really is more secure that Windows. I'd say that they miss to point out that Microsofts Office suite combined with VBA scripting makes Windows more insecure than anything I've ever seen, but they do make some good points, especially when discussing Open Source and security."
You just had to throw in a "well if you stack the decks against windows and set the server up in a very insecure way...."
Do you run OpenOffice/KOffice on all of your servers? Do you even install X? These are all additional security risks. I know, most people who use MS products are scum, but a few of them have figured these similar things out that you really really really smart Linux guys did.
You and your other mindless Linux zealot buddies are why Linux will never be mainstream.
Come on slashdot editors. That should be "whether" and not "weather".
Does the name Pavlov ring a bell?
Which is more secure is such a hard question. UN*X is structurally more secure in many people's opinions. Windows also has the disadvantage that it has many clueless admins (even the certified ones). I think that's a big part here, any OS is as secure as the admin, a well managed Windows box can be more secure than a badly run Linux box... A propper comparison will be much more complicatec than this article.
Security problems exists - it may or may not be worse in Linux than windows...keep your systems updated regardless.
C'mon...this was nothing but flamebait - nothing news worthy there at all.
About the only telling thing is the top line about MS turning towards spending $$$ towards security - perhaps that includes buying blurbs like this saying Linux ain't perfect either.
From the article:
Hemmendinger commented, "I see a lot more stuff coming across BugTraq [about Linux] than any flavor of Unix or any Microsoft operating system." BugTraq is a popular forum for discussion of computer security vulnerabilities.
This is probably true, but only because for Linux, every security vulnerability gets posted multiple times, once for each vendor that has released updated packages, plus once by the vulnerability discoverer (so you get one by the discoverer, and one by redhat, debian, mandrake, suse, turbolinux, grandmasfavouritedistro, etc).
In contrast, with Windows, you only see a posting related to a single vulnerability twice - once by the discoverer and once by Microsoft.
It appears to me if you count each vulnerability only once, there have been more Windows-related than Linux-related.
D:\netstat -a |more
Proto Local Address Foreign Address State
TCP 09-96z:12345 09-96z.xxxx.com:0 LISTENING
The inspector related that the government's tests had indicated Linux was pretty weak on security. Apparently they feel that the open (he called it "promiscuous") development model meant that there were no controls, verification or even logged history of who checked what in, meaning that terrorists or spies could have planted trojans in there. (He also had problems with the stability, but that's not really a security issue so he couldn't make me deinstall for that).
Anyway, I obviously lodged a protest but it came right back with a stamp on it: "Linux is not being considered until the development model is safe." I guess they get a lot of requests like mine.
These aren't exactly a part of the operating system, though, are they? Any poorly set up system will be vulnerable. I'm no huge fan of MS's bloated products and crappy license arrangements, but I mean, really...
Roving Web-Teleoperated Robot
A network is only as secure as it is setup to be.
if you want a really, really secure system, turn of all services and disconnect it from the network (oh yes, and protect the physical location too). that said, imho it is more easier to install and maintain a reasonably secure Linux system than a comparable Widnows system.
Is this a new Linux distro I haven't heard about? Is it Debian-based like Storm Linux was?
I've got a fever and the only prescription is more COBOL.
Lies, damned lies and statistics.
Windows applications will always be less secure than OSS because it's much more complex and used by millions more users. This is the fact that tends to get missed by people who blindly quote stats that they don't comprehend.
Actually this is yet more hardcore evidence that the FSF and open source proponents need to shift to a more modern Extreme Programming model of development and away from their legacy "hacker working alone in a basement" methodologies. I've done this using a modified P2P client for real-time distribution of code amongst a team of 3 other coders over high bandwidth connections and it works out very nicely-even though we were all in different states at the time. It's generally known that studies have shown that teams of four can develop code one order of magnitude faster than 4 coders working separately and my experience backs that up.
This hits at the very heart of the Achilles heel of open source as it tends to be rather unprofessional and willy-nilly in it's approach to development and project management which was fine back in the early 90's but suffers from severe limitations in todays modern and complex software development paradigm. Sure they make more secure software becasue it's easy to make an Xterm secure and not so easy to make an giant enterprise ERP package secure. Lets see these "experts" comapare apples to apples sometime.
Wagner LLC Consulting Co. - Getting it right the first time
Yet again, we find an article that points to the significant number of Linux bugs going through BugTrack. The turn-around time for the patch in Linux is usually quite fast. Commercial software makers are starting to sue individuals for disclosing security vulnerabilities.
How many bugs for Windows have been swept under the rug? How many software vendors out there have patch security holes, and requested that their customers download the latest 'maintenance' patch?
Just ask some of the truly gifted individuals in security what they think of security through obfuscation.
It seems that Hemmendinger argues that the newer the software, the higher the likelyhood of bugs. While that argument sounds valid, it would only hold up under the following conditions.
1. Both platforms stem from an equal amount of design history.
2. Both platforms use technology of comparable complexity.
3. Both platforms refused to make concessions in software integrity to deliver their products.
4. Both platforms actively avoid known pitfalls in thier chosen architecture.
5. Both platforms remove flaws at approximately the same rate.
None of these conditions (and I'm sure there are more) exist in the comparison of Linux to Windows making the "age" argument a very weak one.
I think that most of linux's security risks are there because of administrators. They should only run services and modules that are essential, but nothing else.
Administrators should have physical access to machine, so they can disable anykind of remote shell access. Do not run ftpd as root.. and so on. I think that would minimize security risks.
um, I don't get it. How does newer == "less secure" in this scenario? Sure, the older and os the more time it's had for the kinks to be worked out of it. But doesn't method have something to do with it also? Linux is developed in an open and peer-reviewed environment. It's maturing much faster than windows. There's no reason to compare the two in the way the author's done. Faulty thinking on his part.
What's also got to be factored in is the severity of the bug. A buffer-overflow that lets a cracker rm / is serious. A buffer-overflow that lets code run with the perms of the user owning the service in a chrooted directory is also serious, but much less so.
The author also babbles about the volume of security-related issues on BugTraq... I'm not the first and I won't be the last to point out the rather obvious logical flaw here. If Bugs are getting reported and being quashed then they don't pose a threat any more. If the bugs aren't reported because a certain company based in Redmond Washington won't allow them to be reported... well, it's kinda obvious from there.
That said, it is indeed encouraging to see more and more people concerned about security. I think the message is slowly being driven home.
This must be some sort of joke. The best method of determining the security of a program is to have a team of experts go through every line of code and exhaustively consider the security risks of each block of code individually, and how it reacts with other code. It hearkens back to the introduction to Applied Crypto: given an infinite amount of monkies and a safe with the plans to that safe inside of it, and all the keys to all the safes in New York, how secure can an operating system be if the only person who ever sees a block of code is the guy that wrote it? (Or something like that, sorry for the paraphrase.)
Just about every major worm, linux or windows, has used an exploit that's been patched for a few months or more. The admin is a far weaker link than the OS.
.NET server look pretty good in this area.
Stating the obvious, I know, but whoever posted this flamebait article didn't think so.
On another topic, the moves MS are making with their auto-update tools should put an interesting light on the security landscape. The previews of
Read reviews of shopping cart software
Just last night, a buddy of mine did a security scan of the Linux box I use at home as a gateway for my other 4 computers. The only security problem found was with the version of wu-ftpd that I'm running.
No problem, I thought, I'll just upgrade it. So, my first step was to download it from wu-ftp's ftp site, only to realize I was going to have to figure out how to build it (that was simple, except I kept getting two or three errors in the compilation. I'm assuming my gcc is out of date) and then how to install and replace all the existing stuff (I have no idea how, and I don't have time to learn it).
So, I figure I'll go to RedHat, download the RPM and just install that. Which I do. Ran RPM to install it, no messages, try to FTP in, still running the old version. Shut-down and re-start, same thing.
Folks, I know most of you are Linux fanatics, but if a programmer with 23 years of programming experience can't manage to upgrade a simple application in under 30 minutes, Linux will never make it to the masses.
There's nothing I'd like more than to see Linux replace Windows on every desktop. When Linux is ready. Frankly, I don't think it is, and I think it's still got a long way to go. Sorry.
is that pretty much all operating systems are equally secure. The insecurities in the operating systems are not the same, but neither one is bulletproof. Windows seems more insecure, but that is because more people try to hack it, because more people use it. Linux seems more secure because it is hacked less, which is because less people use it. However UNIX is very old and very open and has just as many ways to get in as windows does.
From what I've experience operating system choice is not a major factor in security. The biggest factor in security is how well the operating system in question has been configured. You could run the newest linux with all the shiniest intrusion detection stuff, but if you let the guest account rm -f *.* you're in a bit of trouble. Nothing is more key for security than proper configuration. And of course, not downloading e-mail attachments in outlook.
The GeekNights podcast is going strong. Listen!
The user makes all the difference. What software you choose to run, and how you choose to configure and audit things. How much care you give to security issues and how much knowledge of basic security you have.
However, if you are competent and security-minded, it is quite easy to make a Linux box extremely secure against all but the most directed and knowledgeable attackers, which are quite rare. If you run Windows, no matter how hard you try you're still gonna be fairly hosed. Some things just can't be fixed reasonably on that platform.
11*43+456^2
In this context, I think that we are rather talking about the (in)security of the operating systems than applications running on them.
-- Reality checks don't bounce.
Linux, which is even newer than Windows and is not controlled by a single commercial entity, can be expected to have even more vulnerabilities than Windows. Hemmendinger commented, "I see a lot more stuff coming across BugTraq [about Linux] than any flavor of Unix or any Microsoft operating system." BugTraq is a popular forum for discussion of computer security vulnerabilities.
Very few of these messages are related to the Linux kernel itself. I find most of these to be about packages included with most major distributions.
So many programs get lumped into 'linux' and this is forgotten.
Imagine if EVERY time there was a patch for a Windows app, it was checked off in the 'windows' category.
Then again, there are more Windows apps than Linux...
Huh lets see Windows Players ?
1- Mighty Netbios ( Most secure protocol invented since '95! )
2- Unicode File Traversal Vulnerability. Appeared like 1-1.5 year ago. Still some servers vulnerable
3- Melisa & IloveYou & others countlessly many Ms Word worms
4- Nimda & CodeRed variants. Millions of computers got intruded in one day.
5- Internet Explorer got 20 unfixed vulnerabilites today according to http://www.pivx.com/larholm/unpatched
6- Windows XP UPnP Vulnerability got public after the week XP was released....
Now come on doesnt matter how clueless you are Windows is not *really* engineered for security!
Never learn by your mistakes, if you do you may never dare to try again
* Gets out a kleenex, wipes off author's glasses*
IIS - enough said.
The actual number of posts may be greater, but how many people install X on their Linux servers? How many people have xmms on thier linux server?
Also, considering that Linux is open source, and thus, hackers can actually look at the code for the OS, it is AMAZING that it is more secure than Windows! Can you imagine how many exploits their would be for IIS if a good hacker could see the source code for it?
Nothing more to be said here
HallmarkOrnaments.Com
Windows Programmers
Well paid. Medium sized grayish cubicles with few restrictions on decorations. Laid back workplace.
Open Source Programmers
Live in basement of parents' home, browbeaten daily by overbearing mother, relentlessly degraded by father.
Windows Programmers
Married to a member of the opposite sex or enjoying a healthy dating life.
Open Source Programmers
Proposition other men in subway restrooms. Frequent 'glory holes'. Masturbate to Hentai porn.
WIndows Programmers
Nice cars.
Open Source Programmers
Bicycles.
Windows Programmers
Enjoy reading books, watching movies, and listening to music that all cover a wide variety of intellectually challenging subjects.
Open Source Programmers
Can't understand anything unless it deals with elves, or dwarves, or space creatures.
Windows Programmers
Secure in the knowledge that their work is contributing to increasing the productivity and happiness of workplaces and homes all over the counrty. Singularly responsible for ushering in the widespread use of personal computers for the masses.
Open Source Programmers
Waste their entire lives fighting in vain to bring down an imagined enemy by creating products that 99% of the computing public will pay to avoid having to use.
There you have it folks, a comprehensive comparison of the two camps.
Cunning linguists
And of course they have experience--that's why they chose W2k.
Thus, any bug-counting stats are meaningless.
And for all you folks who think M$'s ways are best: Do you really think Gates and Ballmer have your best interest in mind when they spout off about keeping bugs secret?
This sentence from the article really drew my attention:
Mainframe operating systems, which have been perfected over decades, have very few security flaws. Security problems on mainframes tend to be caused by administrators' errors.
Obviously, this guy does not know what he is talking about.
My father used to be a mainframe security officer at a Fortune 500 company. He knew mainframes inside and out and was always pretty much on top of things -- and he started his career on old IBM with punch cards, if you see what I mean.
Anyway, his company would hire (once every three years) an external consultant to test the security of the systems my father took care of. This consultant could gain the mainframe equivalent of "root" access in 30 minutes or less.
A mainframe operating system is not secure -- it's very stable (uptime=99.9999%), though, but that's a different thing.
My advice? If you want security, get OpenBSD. If you want the latest gizmo, get Linux (a real Linux) and invest some time in securing your installation...
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Windows suxx0rz, Linux r0xxorz, etc., etc., blah blah. A badly adminned Linux box can be 0wned and r00ted same as anything else.
Security holes happen for any development model, shit happens. With open source, GNU/Linux in particular, I keep an eye on security updates to my distro and that's it. Almost no effort if you use a friendly distro. Well, that and I check not to run services I do not need, use a firewall, etc. I know that as fast as a hole is found a fix will appear and I'll download new packages in a couple days. If I am really concerned I can compile and install in the meantime. Here is where the freedom meaning of free software shines.
Oh, and the title should better be "Open source vs propietary security". Old same old ...
Well, at least linux (the newer distro's i tried like RH, Mdk, SuSe, Deb) lets you CHOOSE your security settings. None of all windows installations i performed asked me which level of security i wanted..
Microsoft has worked very hard to make ActiveX an integral 'part of the operating system' - it's a pain to get rid of it even on older systems, and I don't believe anyone has even worked out a way to properly disinfect it from XP to date (if I'm wrong give me a link, litepc.com is still working on it, it's a tough problem.) ActiveX is also the very exemplar of security hole from the ground up. Despite all the lip-service given recently to the concept of security by Microsoft, this particular policy, by far the biggest cause of security flaws, has been intensified over time, not backed off from. This makes Microsoft systems and security antonymical.
Now there are some smart folks at Microsoft, I can't credit the theory that no one there understands what they are doing. The alternative, of course, leads to what may be denigrated as 'conspiracy theory' but in this case it seems reasonable, for the reasons stated above. What does Microsoft gain by making their systems inherently insecure? A rationale for the 'necessity' of so-called security schemes (that really don't have anything to do with security, but rather with centralised control) such as DRM. Flood the net with insecure boxes and then cash in later by 'solving' the problem in a way that makes you the effective gatekeepers of the internet. Now there's a business model with some profit potential.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
> I think that's a big part here, any OS is as secure as the admin...
I would have said "the admin sets an upper bound on system security". The OS could still undershoot that bound.
Sheesh, evil *and* a jerk. -- Jade
Many people thought prior to Slapper coming out that Linux was somehow impenetrable to malware ... VB has a good article (written before Slapper came out, as it happens) on why this is largely untrue:
l inux_malware.xml
http://www.virusbtn.com/magazine/archives/200209/
Score:-1, Funny
Can this be sufficiently answered until alot more people are using Linux? I mean over 90% of people use Windows still... so probably a equally great percentage of hackers spend their time trying to break it. Since security problems are usually pretty obscure until someone very dedicated finds it, who's to know what's lurking in Linux. I personally don't feel linux has really gone through the 'trial by fire' needed to prove it's secureness.
Now in theory it can be very secure, it is based on Unix which has a good record. However Linux has surpassed traditional Unix's in features- and with more features comes more complexity and more breaking points. The old assumptions about it being a unix shouldn't be highly regarded.
Linux can really be more secure than windows, but lets not go touting it as fact until it's survived mainstream use.
Blender And Linux Fan
I wonder if Windows' security problems aren't as much the fault of the everything-but-the-sink integration and legacy support, and abysmal documentation as they are inexperienced and unknowledgable administrators.
A lot of the IIS exploits are built around "integration features" turned on by default and not well (at all?) documented. How do you disable what you don't know exists? And that's just IIS -- there's more hidden surprises buried in the OS known by hard-core developers and MS only.
Third party resources? You can't say "take a class" -- I've *taken* MS curricula before and its not a whole lot better than the online documentation. A typical 30 hour (4 day) class has about 2 hours of stuff you'd be unlikely to sort out through the UI and docs. Books? Usually no better than the online docs and often *worse*, and that's if you can manage to wade through a sea of 'em to find one that's not just screenshots of the online docs!
My experience with Linux and (predominately) FreeBSD is that while the UI of these OS's is often less untuitive, the documentation, even man pages, while dense is far closer to complete than Windows and there's a lot less hidden "gotchas". One of the great things about textual config files is that most sample configs, especially with stuff like Apache, Squid, etc is that the configuration docs are integrated with the config. You just can't do that well with Windows, which is moot anyway, since MS *doesn't* do it with their default configs.
My point is that while its fun (and often fair) to blame clueless admins, they're also admining a system that seems to try very hard to defy people who want to learn -- Just Click Here And It'll All Be OK. If they could learn and understand the operation of the system(s) and their archtecture they'd get a lot smarter. MS makes it hard to do this so people don't.
In many respects, Linux isn't so much a "newer operating environment" - its pedigree is Unix, and it owes much of its core to long-established developments for much older systems. To say that it is "even newer than Windows" and to cite this as evidence that Linux is therefore less secure than Windows is rather irresponsible, to say the least.
Similarly, the quoting of a few minor-but-exaggerated viruses etc., and to imply that these stack up to anything remotely comparable to the plethora of such issues that plague the Windows OS, is quite ridiculous.
Let's face it - this is FUD. "Microsoft has organized a huge security program" and (Linux is) "less disciplined but more timely" -- such soundbites have been carefully calculated.
Of *course* security comes to more than the Operating System alone; still, one can only gape at such inane comments as "the existence of security flaws -- and of hackers willing to exploit them -- does not necessarily add up to more risk for users".
This is FUD that is based on the vaguest understanding of security, upon one man's comments, upon old, tired misunderstandings about the merits of "single commercial entities" -- in short, it is the usual chest-pumping pro-Microsoft FUD from someone who knows very little about which he speaks.
Who is better, bigger faster? That doesn't help any community very much either.
.rpms, .isos or .exes.
.isos to prevent man in the middle virus patch attacks.
What is good is to ask how to make actual systems better, to catch up faster with patches an so on.
My try:
Besides disabling unneeded daemons, automatic updating should be a priority for almost all users, at least for every desktop (not hardcore) user. MS would have that right if they weren't pushing EULA changes with every update. And checksums of packages would start to be a serious thing, not something we saw but ignore in the same web page as the
But this automatic updating should be entirely configurable, because hardcore users, admins and so on can't rely on third parts to check the compatibility of every patch with the endless configuration they have done. Auto-update could be enabled in any vanilla system, and disabled per package with dependencies with a CLI and GUI tool.
Ohhh, and making sure that this autoupdate doesn't have any bugs too! (as far as possible). May be SSH and server keys in the
Just a though.
We are Turing O-Machines. The Oracle is out there.
I think your IT director is right, rely on an American Operating System, coded 100% by Americans, yes, we're talking Microsoft Windows 2000. Deep in their heart of hearts, Bill Gates, Staver Ballmore and Jim Allchin know that America is the best country for them to live in (if they lived in England, half their personally generated wealth would be taken away to buy heroin for junkies), and they will work hard to make a safe OS that willl ensure the American hegemony.
Linux is fine for a hobby, but I wouldn't trust my country with it.
Man, what a paranoid opinion... People still misunderstand the meaning of free software. Using a Red Hat Linux is as dangerous as using Windows OS. There are no hacker-made Linux anymore: everybody use well-supported distros like Red Hat, Mandrake, Conectiva. You dont have to worry about alien, russians, nazis, hackers or even Bill Gates breaking through your box! By the way, is there something that assures you that Microsoft does not collect users information? Think about it! Think that people use Windows to access Internet for more than 6 years. Remember "Conspiracy Theory", with Mel Gibson. Are "they" tracking everything you do since then? Boooooooooooo!
Second, those hackers smart enough to code for Linux have generally been smart enough to move to America and get an American citizenship. They are smart enough to understand that what keeps Americans safe is the 2nd Amendment. They are no longer crouching in their stinking hovels with nothing but a Dell laptop to their names.
You may call Linux a hobby, but think of a guy with a woodshop in his basement. Would you rather use a bookshelf that he himself lovingly made from only the finest parts or would you rather buy a $15 piece of laminated crap from WalMart?
Comment removed based on user account deletion
Playing devil's advocate here but....
MS could have documentation that is just as good, and contextual like a squid conf file.
The problem is that people stop clicking the question mark cursor (contextual help) after doing it about 10 times and getting "This is a text box, you enter text into it" or "click the check box to toggle this option on or off".
So, IMO, it's not so much that they can't, it's that they don't.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
I'd say that they miss to point out that Microsofts Office suite combined with VBA scripting makes Windows more insecure than anything I've ever seen
That would be a good point if not for the fact that 1) Microsoft Office is not part of Windows, and 2) a lot more people would switch to Linux on their desktop if Microsoft Office (and not some pale imitation) were available on Linux. But it isn't, is it ?
Perhaps the question is not how many exploits are found in "my" or "your" os but what occurs after they are found. ie. turnaround time, transparency, propoganda et al... I would not trade the OS model for the most "angelic" vendor on earth 'casue they'd still be a vendor with their own interests ahead of mine.
And to address the "ease of patching" debate, yes, MS make it easy to apply more closed source code or patches that the end user has no idea about apart from what MS tells them. Remember Windows Media Player... OTOH RH provides the CL utility autorpm that allows checksum verification and auto-follow-deps... Point it at your local FTP mirror sometime....!
Look, some grammatically inclined Slashdot readers can be really picky about spelling and grammar in articles. Maybe it gets on your nerves or maybe you laugh it off.
But "weather" instead of "whether" being posted? That is the kind of mistake an elementary school student would make. Okay, I'll be extra forgiving and say a junior high school student might make that mistake. That is really fucking pathetic nonetheless.
You could change it now, but you won't. That is the *most* confusing part.
I just can't pay for Slashdot when I can't feel like it is a professional product (meaning that you took the extra 4.5 minutes per day to actually look over the spelling of single-paragraph articles). You may think that's ridiculous, but I think the grammar here is ridiculous, so I guess we both have our opinions. I don't want your money though.
"Linux, which is even newer than Windows and is not controlled by a single
commercial entity, can be expected to have even more vulnerabilities than
Windows. Hemmendinger commented, "I see a lot more stuff coming across
BugTraq [about Linux] than any flavor of Unix or any Microsoft operating
system."
The guy who wrote this obviously didn't think that maybe more stuff goes through bugtraq for Linux because there are people actually working to resolve the issues immediatly...instead of leaving the problem for 6 months or more to then release 1 big fix.
I think the fact that it is not controlled by a single entity is much better because then no one is relying on that 1 single entity to resolve issues...which also strengthens the theory behind Open Source software. The software is open to find the bugs and vulnerabilities, and its open to be resolved. People are grateful when someone points out a vulnerability or bug in linux or its software because teams can begin working on it immediatly, whereas Microsoft would most likly see you in court for letting everyone know of any vulnerabilities or bugs.
I've used UNIX and Linux for close to ten years, and by now I have a pretty good idea how to do things in a secure and functional way. I've only had to admin an NT box once, and I migrated services off of it as quickly as I could.
Why? Not because I had any direct evidence of insecurity (this was before the real flood of NT vulnerabilities began), but because I knew I could do a better job with the tools I knew best.
But also:
- the NT machine tended to bluescreen every month or so for no apparent reason. The MCSE on staff was not overly troubled ("Oh I see the problem, it just needs a reboot"), but its flakiness did not fill me with confidence.
- the MS tactic of bundling the kitchen sink with the OS is just asking for trouble. Linux's modularity means you don't have to have a graphics layer on the server, for example, or any other unnecessary frills that provide opportunities for crackers.
- I believe the full-disclosure bug reporting model is orders of magnitude more responsive than what you get from proprietary vendors. Afaik, lots of reported linux bugs == lots of bugs get fixed because lots of people have access to the code.
- really excellent security tools are freely available: iptables, xinetd, snort, tripwire, nessus, nmap, chroot, etc. An interested beginner could make a linux server very hard to break into. I know {NT,W2K,XP} has more wizards and stuff, but is it easier (or even possible) to really see and control what's happening with the OS?
1) The author cited as fact that the age of the operating system is directly related to its security, without any kind of proof. This makes sense at first glance, but it ultimatly glosses over the fact that both OSes are in constant development. New features are added every day. This might make sense if, after developing the system, all the time after that was spent patching and debugging, but this isn't the case.
2) The author has no concept of service vs. system. Most vulnerabilites are in sevices, not at the kernel level. All Linux is just a kernel. Packages are added to make a usable Linux distro.
3) The author cites number of bugtraq entries as a way of gauging relative security, without considering the severity. Also, bugs, like those reported to Security Focus aren't the only vectors of compromise
4) Open source software, by virtue of being free, allows an administrator to install much more security software for his dollar. Firewalls, IDSes, advanced cryptographic file systems, HIDS, and virus scanners can all be downloaded for free.
ActiveX is a BS marketing term MS came up with so they could promote the things you can do with COM. It's splitting hairs I know but ActiveX, the vptrs, marketing, application integration and the whole ball of wax really are a serious problem for security. COM and DCOM have no effective security model, at least when I was using them in '98. I never really got into COM+ or whatever it was as I never opted to take another MS platform job after that last one.
Kind Regards
"A few great minds are enough to endow humanity with monstrous power, but a few great hearts are not enough to make us w
Does Canada have a secure OS?
How come Slashdot never gets Slashdotted?
The fact that there are less bugs on BugTraq pertaining to Windows than there are to Linux is beside the point: Most Windows users don't give a damn about posting on BugTraq. Most Linux users want to improve their OS, so they do post on BugTraq. And if Windows users did care...oh boy would BugTraq see some bugs...
``Linux, which is even newer than Windows and is not controlled by a single commercial entity, can be expected to have even more vulnerabilities than Windows.'' .exe attachments disguised as audio/x-midi inserted in HTML mail...WTF? Linux users are more likely to patch or upgrade to more secure software. The programs used matter, but the human factor can't be ruled out, either.
/etc/*
What they're forgetting here, though, is that Linux is actually GNU/Linux. The Linux kernel is a relative newcomer, but the GNU utilities that it uses have been in existense for quite a while, and have a history of testing on various Unices, etc. etc. These days, what matters is mostly the security of programs that connect to the 'Net. Vulnerabilities exists on both sides, but tend to be more braindead with Windows programs. M$ Outlook Express executes
---
Running as root is bad. I don't want to run as root. But now I can't modify my config files... Hmm, chmod -R o+w
Good, now I feel a lot safer...
Please correct me if I got my facts wrong.
Anyway, my mom seems to want to stick with Linux after all, just in case you were worried.
Kind Regards
"A few great minds are enough to endow humanity with monstrous power, but a few great hearts are not enough to make us w
If that was really the argument put forward by Eric Raymond, it is an incredibly stupid one. Competition does not generally occur on the sub-product level, and is fairly irrelevant to the product-development process. Ford and Volkswagen, for example, independently design their cars through the 'cathedral' process, and they then compete in the market.
It may be that letting random people design a new car would produce interesting results (although I very much doubt it would be better than what, for example, Volkswagen's engineers could come up with), but it would not be the only car based on competition, since the engineers at all car firms are very focussed on what their competitors are doing.
Because, ya know, installing the ubiquitous productivity suite made by the same software company as the operating system it runs on sounds like stacking the decks to me!
--- What
Does Canada have a secure OS?
Actually, they do.
Better than that Lunix crap.
(Ok, so that subject isn't that great, sue me) ;)
I submitted this same story on the 11th and was amazed that it wasn't posted as it's an important debate, not to mention one that is extrememly volitile (which might be why it wasn't until now--get the Monday crowd, so to speak)..
At any rate, there have been tests done that disprove the OSS-is-more-secure model, basically stating that either style (OSS or Closed-Source) can be equally secure. We all know that. What I think is interesting is exactly how both camps go about the same thing (ie: security).
The OSS people find a bug, the author of the affected application is notified (probably by hundreds of affected people, or by bugtraq, or something like that, and he/she fixes the bug, releases a patch or new version and the world is more or less happy. (Some apps might not work, but then that's not the problem of the author.) Time from bug to "fix": about 2 weeks (at most).
Closed-Source people get a bug report, then they have to see where it is in the code, fix it (and here the similarities end) because there is (at least in the commercial business) a desire for backward compatibility and what MS likes to call "regression testing." Once that arduous process is done a patch is released. Time from bug to "fix": at least 2 weeks (unless your'e lucky.)
Really, the only thing I see different is the time involved, both bugs get fixed, but OSS doesn't have to test it with previous releases--the author only has to make sure it works on a "vanilla" install; whereas someone like MS has to make sure that it doesn't break anything going as far back as, say, Windows 98. (Which is pretty far back in computer time.)
I think the real way to describe it is that OSS is made secure faster than Closed-Source. Speed being the essence, that's the rub. If I want security I'd like it now, not later.
Once again we have an article that forgets the history of bug tracking and CERT. There was a time where everyone thought it would be best to alert the company first and let them fix a patch. Then we saw time and time again a company sitting on a problem and not wanting to issue a fix until the next big release they could sell.
/. and everyone in the university using it to crash computers campus wide. However, these idiots, the idiot sys admins and the idiots that made smbdie possible all had equal amount of time to do what they needed to do.
Then, the idea was to make a bug known publically so that the company couldnt hide. Unfortunatly, the company then denied that such an attack was possible. This lead to the requirement of posting source or an example program the exploited the program - which before was just sent to the company - into the wild.
This brings us to where we are now: Everyone (sysadmins, crackers, hackers, the media, and the company) knows about the problem and how it works at the same time. This means the company HAS to patch their software. This also gives your sys admin a better chance since he can know about an exploit and immediately begin watching it or take the effected program away until a patch is issued.
The down side of course is smbdie being posted on
The ultimate network admin tool needs HELP!
Hemmendinger commented, "I see a lot more stuff coming across BugTraq [about Linux] than any flavor of Unix or any Microsoft operating system."
This makes no sense for several reasons:
1 -- "a lot" more; how much is "a lot"?
2 -- Linux the kernal or does he mean Red Hat?
3 -- Didn't MS make a big deal about NOT posting to BugTraq for (snicker) "Security Reasons"?
Hemmdinger sounds like a shill to me, and I don't even use Linux (Red Hat, et al) anymore.
This
"Shut-down and re-start"!?!?!!?! WTF kind of troubleshooting is that?!?! Why do I have the feeling you don't know what you're doing? It seems that Must Consult Someone Experienced doesn't apply here...
First of all is hard to nail down what exactly that means. When most peoople utter those words, they refer to Apache/Linux/Linux Apps vs. IIS/Windows/Office.
Very few security issues in the recent past have really had much to do with Windows itself, mostly IIS and some Office/IE vulnerabilities. Even with those, frequently the problem is that the administrators of targeted systems are not sufficiently security minded. Also, MS products draw a lot of attacks, simply because the systems are such a large target.
The enhanced security of Linux, at least in part, is a self-fulfilling prophecy. When administrators are highly security concious, they will often go to Linux to drastically reduce the sheer number of attacks they receive and are influenced by reputation. Sure Linux boxes with Apache have had a number of problems and worms, but those administrators are far more likely to update Apache than IIS administrators.
One thing that really does make me think it would be difficult to update Windows as easily as Linux systems is the model for updating busy files. Under linux, the in-use inodes are kept open for the processes that need them, but the filesystem is updated for future processes. Under windows, the file updates are scheduled for reboot. Since so many of the updates for Windows touch so many files, updating IIS will likely require a reboot, huge no-no for mission critical apps..... Aside from that, I'm not so sure that Windows is that much less secure. However, I prefer linux because it *is* more flexible..
XML is like violence. If it doesn't solve the problem, use more.
"Weather" is a noun refering to the state of the current atmospheric conditions.
"Whether" is a conjunction used in indirect questions to introduce an alternative.
"Editor" is one who prepares written material for publication or presentation, as by correcting, revising, or adapting.
Someone you trust is one of us.
Almost nothing is routinely secure "out of the box". And even OpenBSD has had its share of black eyes.
It's not a question of "How secure is it"...it's a question of how securABLE it is. IIS is securable, so is Apache. The problem with IIS is that it's usable by the low end of the technical spectrum who don't know or don't take the time to secure it. People who use *nix/*nux and Apache are almost techies by definition. They generally have the attitude to secure their boxes.
The irony is that with a flurry of points and clicks, IIS is easier to secure than Apache. However, nobody does it.
---umm, I am guessing if what you say is true that you make enough money to afford any normal computer you want out of your own pocket. with that said why don't you use mac classic on a newer model souped up tower? not osx, "classic". Try running that idea past your higher ups and see if it passes muster. I know you lose that groovy 1337 feeling of having the command line, but if security is the issue..... well? well? anyone care to comment?
What everyone seems to be missing is the difference in scale between a windows exploit, and a linux exploit.
Linux, if you hack a mail client you can send spam to people on YOUR mailing lists.
Windows, if you hack a mail client you can send mail to people on THEIR mailing lists.
Most times linux exploits get you the very lowest level of security access. Yea, you got in, but you hardly got root priviledges out of it.
Windows on the other hand, has several known and documented exploits that not only get you in, but get you admin priviledges to go along with it.
Linux is very protective of it's hardware access (As anyone who's ever tried to run games will tell you. =P). Windows, on the other hand, goes out of its way to make hardware access easy and painless, both to the user and the abuser.
Exploits exist for both systems. But which ones would you rather have to deal with?
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
And my Linux box combined with a rootkit makes it more vulnerable than Windows + Office!
Duh.
That's kind of funny, I was reading their distribution's web site news (which goes back to Dec. 2000), and I didn't see any mention of that, though I did see mention of work being done on integrating with Linux 2.5, posted in late August. How odd, no one must have told them that the project ended, according to your comment.
--- What
he has access to.
My experience is that it is really hard to find *good* documentation for advanced topics in the Microsoft world. (especially when you need it). I guess that there are good books out there, but when I needed information I was not at the bookstore.
On the other hand, Linux/Unix is very well documented. And when you hit the wall, you can always look around in the source code.
Panayotis.
When you get older you will stop caring about trivialities of teen angst like worrying over freedom of software, manufactured bands like Britney Spears or "evil" Microsoft.
Teen angst is something that results when you realize that the whole world is screwed up and you only have a few useful years to do anything about it before you get sucked into being a part of why its so messed up. Post-teenage angst is that hopelessness that you feel when you realize you wasted your only chance to change your miserable little corner of the universe on keg parties and chasing after females that rejected you anyways, and now you've been sucked into the whole machine and must grind out your remaining years as another redundant cog that perpetuates the whole thing.
I know. I was you, now I am the cog in the machine content in my own little niche and see absolutely nothing wrong with it.
How do you disable what you don't know exists?
I knew how to disable it, and I didn't require documentation. Maybe you just need to get a clue.
everybody has heard (and many agree) that any codebase will have x number of bugs (including vulnerabilities) per n lines of code. the more mature the codebase, the fewer bugs may remain, but they are still there. solaris has 'em, linux has 'em, even openbsd has 'em.
no one should doubt the capability of microsoft's core programmers to create solid, robust and secure code. anyone who does, is not being serious.
the problem arises because those same programmers must pack many things into a base os install. for example, to install windows and have it work means i must have the entire windowing system installed and operational. it also means that ie must be there. i have heard from a microsoft employee that if i remove the media player dll from a win2k box that the entire box will cease to function, though i have not confirmed this. i imagine there are others that could be added to this list.
in the unix/linux world i have the option (though imperfect) of leaving out everything except the kernel, core libs, core services and the service / services i want the box to provide. all other code is not only turned off, it just isn't there. which means fewer lines of code, which means fewer vulnerabilities.
last i checked, the majority of vulnerabilities for both win2k and linux came from various 'non-essential' programs, programs like the browser that i don't really need on a webserver. granted, there were quite a few for iis, but even its vulnerabilities come largely from additional, non-essential code that is automatically installed and required to be there, but for non-technical reasons.
therefore, to make a more secure windows, that would conclusively compete with *nix in this arena, microsoft should release a version of windows that can be cut to the bare bones, something i could run headless, without a browser installed, without outlook express installed, etc.
would microsoft business allow such a thing to happen? perhaps not, which means microsoft programmers will forever have the deck stacked steeply against them.
its too bad.
In fact the only real hard statement, Linux, which is even newer than Windows is wrong if I remember correctly Linux was arround when windows386 was out, and I know I was using Linux before Windows95 was released because I remeber waiting to send in the free upgrade certificate on my first pentium machine. windows 3.10 was not an operating system by any means it was a windowing enviroment built on top of DOS. Are they realy saying that Windows XP has anything to do with 16 bit windows 3.10? I might buy an argument that Windows NT - Windows 2000 - Windows XP represent a line of evolution, but Windows 3.10 doesn't belong in there
.
Apocalypse Cancelled, Sorry, No Ticket Refunds
I am sure that Windows will weather any bad press comes from this weather you are comparing Windows Security to Linux or even TCO.
i don't give a rat's behind about hype when it comes to the fact of security holes. its how those holes are plugged that gets my attention. if the hole is not plugged, then it's solution is smoke in my eyes. as a software contractor of secure internet solutions, i am forced to look at the bottom line. the solution of 'do not ask, and do not tell' is weak, and barren of life. maybe its time to ignore the siren's song of usability for certain 3rd party operating systems. and for these same 3rd party operating systems with puffed up egos of to open source their product. frankly, i do not care. i stopped being disappointed when linux became usable for prime time business solutions.
by the way has anyone noticed how shrill the hype is in certain washington state software firms?
Perhaps you hit the wrong button? I didn't write that, I didn't even quote it. I think your response is pretty much on the right track, though, as a response to the other poster. Except for the last bit which does seem to be a response to me, rather than the other poster...
Ahh, but these are totally different circumstances, IBM didn't develop and market a technology that made it easier than before to write and propogate viruses, now did it? Microsoft has without a doubt done that in the case of ActiveX, going so far as to put an enourmous amount of effort into trying to make it impossible to remove the security hole thus created, the only question is why... now it would be laughable I suppose if I suggested that this was the sole reason for ActiveX, there are clearly other reasons, but I think one would be seriously underestimating the collective intelligence level at Microsoft to suggest that they aren't at least aware of the effect this has had, and actively planning to market their DRM as a solution to the problem they've thus created.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
The difference between your post and his (the elitist class bullshit), is that he was joking. You were not. Get a fucking clue.
mmontagne wrote:
Codifex Maximus ~ In search of... a shorter sig.
for instance, slapper requires that you install gcc on your server. if anyone installs a compiler on a production server, the response should be "WTF!!!". linux flaws are more related to the applications, not the core operating system. this is the key point. most microsoft servers/services are integrated into the operating system. which makes patching a) harder and more time-consuming, and b) more prone to create other breakages with other software. take for instance sendmail. lots of features, lots of holes. so, on linux, you can use postfix, or other MTA's. are there any other on windows? (please don't count novell/groupwise). i think exchange is a nightmare, eh? comparing linux vs. windows holes is meaningless. one is application based, one is OS based.
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
In fact, pushing all the responsibility down on the user is a very bad way of securing anything. Most poeple care more about functionality than security. We as developers need to pay more attention to finding ways of implementing non-intrusive security. It may include more lines of code, but it will certainly pay off in how many of your users end up screwed by an exploit in YOUR app.
I'm just waiting and hoping for automated code audit for security. That would possibly be the greatest contribution to computer security since encryption!
Stop the brainwash
Hacking the Network
Let's compare two similar items, the kernels.
Linux 2.4 is the current kernel, and has been released for operational use over a year now.
Windows XP is the current release of Windows, and the XP-series of kernels has been out about the same length of time as the Linux 2.4 kernel.
So, they're nearly the same age.
If the author wants to claim that Linux is newer than Windows, he must mean that Linux has not been around as long as the pre-95 series of Windows, which was not an OS but merely a shell to DOS. So, Linux development is older than the current development tree that Windows is based on, whether the Win9x/ME kernel or the NT/XP kernel.
Of course, maybe I just can't operate a calendar - I'm no professional journalist after all.
Illegitimi non carborundum
I've *taken* MS curricula before and its not a whole lot better than the online documentation. A typical 30 hour (4 day) class has about 2 hours of stuff you'd be unlikely to sort out through the UI and docs.
My thoughts exactly when I took the NT server/admin/whatever course. I realy felt like I had been had (or that the company I worked for had been had).
Those awfully expensive Micro$oft courses do a la-la job of telling you what the software can do, but leave out entirely *how the software works*, which is exactly what serious admins need to know.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
Auto-update may be a promising feature, if it weren't for the distressing frequency of Windows patches to break previously functioning systems.
There's a reason why responsible system administrators always test Windows service packs before deploying them. Some bugs have been rather infamous, for those who remember the NT service packs.
Illegitimi non carborundum
I love it when people argue, as in this article, that Linux is less secure because more security holes are posted than Windows. There are two reasons why this is a specious argument. First, there is little doubt that the holes are there in Windows too. It's just that they don't get found as easily because of the closed-source nature of Windows. That doesn't mean the hackers don't know about them. I prefer *everybody* knowing, which is what tends to happen with open-source code. And, when Windows bugs are found, you certainly aren't going to see the bad sections of code posted to Bugtraq...
Second, the holes in Linux are generally less problematic than the plethora of VB script and other bugs in Windows. When a bug is found in fetchmail, for example, it's a lot harder to exploit than VB script execution in Outlook. Also, a small percentage of Linux users actually run fetchmail, but LOTS of people run Outlook (not to mention all MS Office apps). So, on Linux, unless a bug is found in the OS itself or in some program that's intrinsic to Linux's operation, it's going to be hard for hackers to exploit. Since everyone on Windows uses IE, Office, and so on, there is a much higher payoff for hackers.
It's sad how many so-called security experts are really just apologist shills for Micro$oft.
VBA scripting makes Windows more insecure than
anything I've ever seen
Yes, and computers that can run programs written by users are also insecure.
You can malign powerful features like scripting of MSOffice applications but not having that kind of easy application programability available in *nix environments is not in my opinion a better thing.
Truth is, unless your machine can only execute programs from ROM, your machine can be coerced to run something nasty. Why focus venom on scripting features just because they exist?
Integrated Application scripting is a feature all application suites are marching toward (for good reason) so figure out how to secure them not how to remove them.
Security comparisons of this box versus that box is a bit rediculous. No box can handle all aspects of security on their own. DoS attacks can not be stopped at the box. Port probes if conducted over a long enough time frame are nearly undetectable. One compromised box can be used to compromise all boxes on a subnet.
That's not to say that security is impossible, it's just that it is amorphous. It's as complex a problem as determining the weather or fighting multinational terrorists, simply because they change from day to day. To make matters worse, from the beginning of the internet any machine that is connected to the internet is a target for every hacker on the internet. Those are lousy odds.
The most secure systems these days are protected in multiple layers and the number of companies that are producing multi-tiered security solutions are growing. Still, without redesigning the internet as a whole I don't see security getting better, just more complex, costly and necessary.
...because they are both insecure enough to be a hazard in a real world situation. If I want to run a secure box, I'll run a BSD (probably OpenBSD). One remote exploit in six years is a bit better than a new one every month (a trend both Linux and Windows seem to share). The only way to keep a Linux or Windows box secure is to patch it almost constantly. To be honest, that is a task that sysadmins don't want to be doing all the time. There are much more important things to be doing.
please use "whether"
Which is probably why OE6/OLXP block attachments by default. Besides, Message Source (Alt-F3 in OE) is your friend.
To get even more picky, Windows is used as a generic term. Most GNU/Linux distros are older than Windows XP or 2000. Some Linux and BSD distros are older than Windows NT. The core security model of all *nix systems is much older than any Windows security model.
I didn't think much of this article, basically because it didn't really say anything.
My beliefs do not require that you agree with them.
Malda's Law: All sigs end at 120 characters.
... the fact that no one really uses them is a testament to the fact that they are not really needed.
/dev/sda1 / ro
... then run all user accounts and server services in 2 or 3 separate chroot jails ... users never see the real / filesystem.
... if you want to use ACL's on your multiuser box that provided login shells.
As for the risk of doing "administration as root" have you ever heard of these commands:
mount
chattr
sudo
jail
etc.
In other words you can set up a Linux or Unix system to have one non-root user do all administration. You can set attributes on files so that root cannot change their contents or remove or copy them. You can mount partitions so that no program execution is allowed on a partition, so that it is read only, so that a reboot is required for changing file attributes etc. Oh yeah
This "hardening" is available out of the box and free.
The classic was the PPC linux box on the net with root password etc all publically available. It was never hacked over a 400 day period.
Oh yeah
Admit the truth: Unix is much much more secure than windows. Even if you continue to use windows there's no reason whay you shouldn't live in truth.
I love it every time this argument comes up. It always has very few facts, and lots of emotions. It's fun to see all us nerds get so defensive about an OS. (I admit I do it too.) However, one FACT that we should focus on is this:
Security is the inverse of Convenience!
The more convenient something is, the less secure it will be. Windows, Linux, Solaris, etc. can all be very secure depending on what runs on them, and the pain, time, and messyness invloved in locking them down. Linux distros have many tools to aid in configuration. Use them, and your box will probably be less secure. Use a default Windows install and you will probably get hacked. So as some comments have pointed out. And now for my guide on how to secure any OS:
Use the Sans (I think) guides on hardening systems.
Have a good sysAdmin that knows more than clicking through wizards to set stuff up.
Keep everything patched and up to date.
Restrict user access as much as possible.
Turn off services that are not used.
Review the log files.
Use packet filters on your router.
Unplug the box for total security.
Ramen, Slapper, Scalper and Mighty may sound like Santa's new team of reindeer...
Not really. They sound more like the kind of law firm that Microsoft would hire.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
In these type of discussions, Linux is equated with the Linux kernel, some device drivers, and maybe a handful of utilities like sendmail and so on. After that you get into debates about scripting languages and window managers and desktop environments and all that--none of which could be considered part of "standard" Linux.
Standard Windows, however, includes graphics libraries and scripting systems and a GUI, and even tools like file browsers and Internet Explorer are considered part of Windows. Not surprisingly, most of the security problems are in those high-level tools, not the kernel itself. Now it could be argued that the kernel shouldn't allow tools to cause problems, but that's wishful thinking. Microsoft introduced a scripting language into Word, and that's been the cause of so-called "document viruses," for example.
To do a fair comparison, you need to put together a Linux machine running KDE, Star Office, a graphical email client, and so on. And then you have to consider all security exploits in KDE and all applications that come with it. But of course that's never how comparisons like this are done. If a KDE application is at fault, then we're quick to dismiss it as a KDE problem, not a Linux problem. And so we run in circles with this kind of meaningless argument.
Yeah, it did kinda suck not to be able to even finish the verse :)
I just changed my sig to that, I'm thinking it will change again soon, I don't particularly like that one, although Lambchop was one kick ass bitch.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
and you are wondering why it doesnt work.
Switch to Gentoo-
emerge makes upgrading SO EASY.
emerge is my friend, and allows an incompotent former windows 2000->Mandrake lover like me to admin my servers effortlessly
(plus rh8 is fugly, but thats a different story)
This
If you ever noticed, the most henious of the windows problems come from not having a clear line between data and process. The exceptions to this are code red and nimbda, which could happen to any of the OS's.
All of the worms and viruses live on because you can embed code into and document. Have an html document, add javascript or VB Script. Same with Word, Excel, emails etc.
The concept of code and information being the same thing sounds like a dandy idea and solution to all of life's problems, but, as long as you can mix code in with a document, you will have worms and trojans coming out of the wood work.
-- Many men would appreciate a woman's mind more if they could fondle it
Windows is remarkable because it consists of many fat vertical applications running on a relatively thin OS.
Security has to be implemented in each application at many levels.
Linux (and Unix) have a much more robust underlying OS and applications are relatively thinner.
So Unix applications are vulnerable when they (e.g.) chroot to access system resources.
But Windows applications remain vulnerable all the time.
There is really no argument about which approach will work better in the long run.
Sig for sale or rent. One previous user. Inquire within.
Just a small recification:
Datastructures like you descibred get thrown at you in the first year of University (well, if you do computer science of course). They are often documented in different "hands-on" programming books. It's the basics of CS, and I am convinced you should know them better than your firstborn, but it really is pretty basic stuff.
Linux kernel
GNU binutils
glibc
Microsoft Windows 2000:
Windows 2000 kernel and DLLS
Internet Explorer
Outlook Express
NetMeeting
Pinball
The Kitchen Sink
etc.
The choices of what you don't want to install in Windows is very limited. I do custom installs whenever I install any operating system. Windows comes with all the bells and whistles, free of charge (yeah, right!) and installed whether you want them or not.
Ever try removing the pinball executable in Windows 2000? "System Protection Services" pops it right back in place! Since when can a pinball game be considered part of the operating system?!?
At least Linux allows you to install just the pieces and parts you want. Especially on servers, a minimal system is inherently more secure. Its simple guys and gals: if it ain't installed, you can't exploit it!
Note for the purists: Yes, I've left out some packages that are required for a functional Linux install. Stop nit picking and get my point.
"Despite the intense battle surrounding the open source, the NSA will
still fund research on secure operating systems based on Linux as well as
work with US companies to create better security in their own operating
systems."
Reading the Whole Thing, as usual, gives you perspective one the whole story.
--- What
Weather
and
Whether
Are two different words.
I don't understand- the whole point of Linux is that it's *open source,* meaning that anyone can read the source files. So how could anyone put a worm into them, without someone else seeing it?
I'm sure all kinds of crap could find its way into a Linux distribution, but if you download one from a trusted source like Debian (which is very well reviewed and tested), I don't see what the problem is.
We have this discussion in one of the major norwegian newspapers regarding the security of using Outlook as an email client, where the commenter from MS in Norway actually admits to one of the big problems that has existed in Outlook was 'bad design by default'-additions to the program. I suspect that this heavily goes into other MS applications as well. Link to Norwegian Article[Dagbladet.no].
;)
The other thing that I feel is a little interesting is how all these reporters manage to "overlook" the fact that what they describe as 'Linux' is what Linux-users would call a 'Linux Distribution' or 'Linux Platform'. (How many security errors have we seen posted for the Linux kernel the last year?)
But - as previously stated in the article, and actually also by the commenter from MS in the article I refer to earlier, and I quote the MS commenter: "Security is something you achieve by a combination of technology, good routines, and knowledge. (As in good administrators) It is misleading to tell someone that they can just change their OS Platform, or technology, and then they're safe". Quite good comment, for someone from MS
God does not play dice - Albert Einstein
wHY d0n't j00 sUk m1 D1Q 4$$h0l3? y0 M4M4 4lR3dy d1D! SH3'S fUll 0F m1 sPUNK1 g00dN3SS.
Ummm... there are? Why? I didn't realize that giving away software that is already free counts as "warez" dood. Maybe you need a little re-ejication?
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
That is so true...
:)
Day 1 - a new Windows OS appears..
Day 2 - Large book with 1000 pages of screenshots entitled - "Windows xxx - the bleedin obvious" is published
Day 7 - "Instant Experts" return from MS certified class where they were taught 30 hours of "The Bleedin Obvious Admin 101" - how to fill out properties forms and click buttons. "Don't try to peek behind the curtain now - just click the buttons. To make the OS secure, for example, click the button marked "make my computer secure". No actual networks/computing/API etc knowledge required!, and certainly none imparted on this course!"
WHY are Mom & Pop running an FTP server? For them, this is therefore a non-event.
For you, you've had a problem, and a lot of that is the way you've gotten used to working. Remember the switch from FORTRAN to C++?
That switch cost me *hours* of frustration because it was so different. You'll have the same with Linux until you learn what the system is trying to do.
Why an Os is more secure than annother matters mostly to security companys and os makers.
But from the implementing viewpoint it's more the issue of who usually dose the best.
The reason matters to Linux people so they can keep pushing it and closing the problems.
The reason should matter to Microsoft as they can then revamp and make the next release more secure however instead they use it to nitpik and say how "well you COULD make Windows more reliable"... Sure and you could make Linux user friendly but unless your an expert in the platform it's not gona happen.
The whole reason "user friendly" matters is becouse only a few people can preform small mirricals.
The typical Linux installation is more secure than the typical Windows installation.
Maybe it's the clueless Win admin... if most are clueless you can forget finding one with a clue.
Maybe it's poor documentation... Well do we have the time and resorces to compile good documentation? Wouldn't that money be better spent elsewhere?
Maybe it's just bad software.
Maybe crackers just target Windows machines.
What ever the reason the results remain the same.
The same for viruses. No matter how many times anti-virus companys release Linux viruse alerts for viruses that don't exist untill somebody actually makes a virus for Linux there isn't any reason to be conserned about them.
I guess non-experts should watch for Linux virus alerts etc becouse it's safer than trying trying to explain worms, trojens and back doors that remain a consern to Linux.
PS: Yes I know there is ONE virus so there is reason to be conserned about IT.
Use sesnable precautions such as actually using a password on ROOT and not running software as super user.
I don't actually exist.
I am not an experienced sysadmin, but I have found sysadmin tasks to be pretty easy with Debian. Here is how to run a server with Debian:
- howto/
0) install using the Debian "stable" branch. (Use the pgi to install; it's easy.)
1) once a week or so, run the commands:
apt-get update; apt-get upgrade
These will go out and get all the latest updates to your packages.
If you update your packages, worms like Slapper will not be able to get into your system.
Debian also provides a really excellent howto. Any Debian server admins should study it:
http://www.debian.org/doc/manuals/securing-debian
P.S. I'm sure Windows systems can be made secure, but it has to be more work than securing a Debian system. There is nothing as cool as "apt-get upgrade" on Windows.
steveha
lf(1): it's like ls(1) but sorts filenames by extension, tersely
Well, while people were discussing here about security, in one of my works a Linux box was just hacked. Frankly, I am an anti-Windows. And please note that I been more than 15 years in touch with this OS (since the first beta). So my anti-Windows feelings are deeply rooted in inside my experience. It will be hard to change someone who dig up in several Windows, looked to tons of code and worked in more than 15 jobs... Besides I have a relative who managed to see who's BG from inside, so I have no sympathy for that guy.
However I had and have no doubts about the security of Linux. Because I know its level of security, I know it is much better than Windows and I know that if an admin takes care of its boxes, then Linux is much more secure. But not inpenetrable. People do hack it (I hacked it very frequently btw) and hack it deadly. And the worst is that a hacked Linux box can be 10 times deadlier to your network than a silly Windows machine. That's a trouble Linux has - it is too powerful for both sides. Besides it is even more powerful when you go into combat. Fighting someone installing rootkits and changing every piece of soft in your machine is something. It is spectacle that no Holywood director can be able to describe. It also can be timeconsuming, depressive and boredom like the hack I'm fighting now.
To work on Linux one should take care of a few things: Absolutisms and maxima are dangerous here. If you came to see the gun then learn to shoot or someone shoots you. Forget all those books and "Hackers", enter the Matrix religion and learn from your experience. And most: If you can't stand up maybe you should choose something else, but don't go flaming because you feel not smart enough. It makes you look like a jerk.
Not only is it the distro most geared toward programmers, a simple 'apt-get upgrade' would have done what you wanted.
"Gold still represents the ultimate form of payment in the world." - Alan Greenspan, 1999
If M$ security patches delivered security, M$ would not have a bad reputation for security. I'm tired of hearing this old saw because it is not true. M$ security "updates" are usually huge, hudreds of megabytes, and contain far more than security updates. It might even be argued that M$ patches create more exploits than they fix becuase M$ is so bussy trying to screw everyone out of playlists and other silly marketing data.
Aberdeen, extensively quoted, is obviously a paid whore and clueless. Anyone who would compare the security of the "not designed for security" M$ world to the peer reviewed world of multi user Linux and not see one as clearly superior to the other has loose screws. Their website states, "Unauthorized use or reproduction is forbidden." I'd say there were many things they don't get.
Friends don't help friends install M$ junk.
Although I sympathize with you, I did notice a flaw in your installation procedure.
At no time did you ever mention that your read the README file or attempted to get any installation documentation.
I agree that many can replace their car's AC compressor without reading the instructions, especially if they have had some experience in auto mechanics, but many of these replacements will not have the lines bled or dried properly, and even fewer will include the 1/4 cup of oil needed on some compressors to prevent them from going bad next year.
Experience can be a great asset, but it cannot generate knowledge on the fly.
AAAARRRRRRGGGGGGGHHHHHHH!!!!!!
My kids outgrew Lambchop several years ago, and while I always liked Shari and Lambchop, when my kids sang that one it drove me crazy!!!!!!
BTW, Charlie Horse was the real star of the show!
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
I was thinking if there is some study about comparing fixes over time of open source and closed source. My guess would be that open source had more of a bell curve type of distribution where there are a lot of exploits and fixes as the software reaches maturity and then, since the source is known there are only very obscure bugs left. Whereas with closed source the distribution is more lineal cause there are still a lot of bugs even after some time because there is no source code.
Maybe somebody can compare something like
Windows NT 3.51 with all patches and
Debian Slink with patches
and see wich one has had more exploits in the last year.
This article is worthless. The author starts out with a mention of the four horrible 'linux' worms (that affect apache, not linux) and then goes on to refer to Operating Systems as 'programs'. The level of 'cluelessness' in this article is astounding. How can you claim an OS is insecure by citing insecurities in an application that persist across multiple OS's? The argument completely falls apart even if you accept the pathetic premise. Nothing to see here... please move on...
weather Linux - "when it reigns, it poors"
duh!
>> How do you disable what you don't know exists?
If you don't know what exists, why are you the one installing the box to begin with? Most of the IIS exploits rely on an admin not securing his box, even simply setting read-only on the page folders would eliminate well over half of them.
MS has organized documentation, they're just not timely with it. To date I haven't seen one page that I needed when I need it. what good will organized documentation do me 2 months after an attack? I'm afraid you've run out of time - morpheus.
When Microsoft compares Windows Security with Linux/Unix security, they commonly show you all the cute security features of Windows 2000 and then compare it with a freshly installed Red Hat 7 box (or something like that, debian, SuSE, whatever you want).
What about comparing the most secure setup of Windows with the most secure setup of Linux or Unix?
Now you end up comparing Windows 2000 with HP SecureLinux or with Trusted Solaris, Trusted Irix, and so on.
The most secure setup of Windows 2000 has C2 level security (discretionary access controls capable of defining access to the granularity of a single user, audit trail), while the most secure Versions of Linux have things like domain based access controls (however they are not certified at any TCSEC security level, not even C2) and the most secure Unix environments have B3 level security (structured protection, zero design flaws and minimum implementation flaws).
Just take a look at how security mechanisms work, maybe compare Linux+Pitbull/LX (domain based access control) with the most secure Version of Windows 2000 - and try to imagine, how DBAC keeps your computer secure, even when somebody hacks your sendmail daemon.
Now go and look for a Version of Windows with zero design flaws, or maybe just a B1 secure Version of Windows, good luck.
regards,
octogen
Some further information:
Trusted Solaris, Sun Microsystems; ITSEC EAL4 (exceeding B1 security);
Pitbull, Pitbull/LX, Argus Systems; ITSEC EAL4 security for AIX and Solaris; Domain Based Access Control for Linux (Pitbull/LX);
XTS/300, Getronics; TCSEC B3;
Firewall Server, BorderWare; (Unix based Firewall), ITSEC EAL4 with EAL5 vulnerability analysis;
Windows XP, Microsoft; TCSEC C2;
and I use Crossovers setup.
I guess you need to learn boy
The question is how thoroughly the code is reviewed. I mean, the Linux kernel alone is more than a million lines big (even more, I dunno the exact numbers). That's a hell of a lot of code to watch about. And that's only the kernel itself, not counting any services/apps.
;))
Most malicious code can be very short, given that the person who writes it is competent enough (which I'm not, unfortunately
In any case, the issue is not how many bugs there are in either system, but how easy it is to secure and audit either system. For example, it's much easier to stript down a Linux system to a tiny set of well-understood processes and services because it's all open. With Windows, much less of that is documented, and I can't figure it out from sources; it also changes with every release.
A storage solution group site:microsoft.com "Aberdeen Group": 397 hits Aberdeen Group directors homepage http://dantanner.tripod.com/djt-index.html Resume http://dantanner.tripod.com/DJT.htm Consultant, Advisor, Product/Market Manager, Editor, Trainer with successful track record. Leader. Organizer. Planner. Doer. I have superior interpersonal, management, training and PC skills. I am an outstanding communicator and presenter. I am an experienced problem-solver. I am a business and scholastic award-winner. I am a Microsoft Certified System Engineer (MCSE) and Microsoft Certified Professional plus Internet (MCP+I). Executive Editor, Computer Design Magazine Published multiple issues, with supplements, on deadline with staff downsized 66%. EDUCATION, CERTIFICATIONS, AWARDS Microsoft Certified System Engineer and Professional plus Internet (ID#1169361): A.A., Electronic Engineering; Monmouth College (NJ), County Scholarship. B.S., Physics/Mathematics; Monmouth College (NJ), National Physics Honor Society. MBA Studies, Nichols College (Dudley, MA), A- average. Computer Science Studies, Worcester State College (Worcester, MA), A average. United States Navy Electronic Technician School, Great Lakes, IL, first in class. Certified Teacher (MA/NJ) physics, mathematics, general science at secondary level.
meridian at tha.net
So the only solution is to write the OS yourself with trusted employees, ignoring that most attacks against a company (and I'd assume that government labs would at least partially qualify) are internal attacks.. Unless, of course, you really want to audit Win 2k's source? Or just trust the NSA's Linux. :)
Debian has a very nice howto that tells you how to disable ftp, telnet and some other stuff. But still I would prefer if there was a single install option that allowed me to automatically disable all the potentially insecure services. This way I could avoid the trouble of guessing what to do myself, and i could avoid the chance of making a fatal mistake :)
This is why we should not allow programmers to moonlight as system administrators. As a programmer, of course I expect you to never, ever, code up a buffer overflow exploit. But please leave system administration to professionals who know how to do the job. A system administrator of 2 years experience or less (usually way less) could do this with ease and correctly.
now we need to go OSS in diesel cars
Well, legacy support of requiring all programs to be allowed to access all RAM and hard disk...should have a little influence on security problems...
In DOS/Windows, deleting anything on disk is not a bug. It's a required feature. Thus there is nothing to fix...other than fixing the buffer-overflow which was used instead of just directly making the correct system call to alter the disk.
It's a good article, certainly. Anybody who is reasonably intelligent with regards to security and understands exactly how these viruses become problems would understand that Linux is no more secure than Windows. The only thing preventing more widescale problems is the relative obscurity of the system.
Leave app developers to do their app developing, and let sysadmins secure their box for them.
Of course, this doesn't even touch on his real problem: Linux on the desktop
there are evil daemons lurking on my unix computer
It amazes me. Really. Authors bandy about Slapper and its varients as a new kind of Linux boogyman (despite the existance of previous Unix and Linux worms) - proof that the argument for Linux, and perhapse even Unix, security is falling apart. Yet there is no talk of actual numbers in the wild. No talk about how long the actual window of vulnerability from discovery to patch existed.
Meanwhile... my organization's main VPN service (running a Microsoft PPTP server... unfortunately) has been vulnerable to a DoS, and possibly a remote compromise since at LEAST Sep 26. Exploit code that demonstrates this vulnerability was released shortly after (I believe Oct 1). Yet there has yet to be any word from Microsoft acknowleging the issue, much less any forthcoming fix/patch.
Microsoft PPTP servers - Win2k, WinXP, AND WinNT 4.0 sp6a (I have personally tested Win2K and WinNT varients) are all susceptible to this exploit as demonstrated by this code - and have been for over 2 weeks.
Sure. Sticking a Sun box, or Linux, or even OpenBSD in your server room doesn't give you instant security. Unix is not a fire-and-forget solution. But these folks have been in the trenches, successfully dealing with the technical issues of security for the last couple decades.
Microsoft still seems to see security as a marketing problem.
Who? Just who thought Linux was a magic bullet against malware? Point them out. And I'll show you an idiot who has not read RECENT history.
Sure - there are some basic architectural decissions that make Linux more resiliant than its Windows bretheren. But the history of Linux (and other flavors of Unix) worms alone show that it is not impenetrable - a history that produces plenty of examples from now until late 1999, a span of less than 3 years.
It amazes me how often zealots - both Linux and Windows - seem to view Slapper as some major new event. Its not. It is not the first Unix worm. It is not the first Linux worm. It didn't infect systems in any particularly unique or novel way. Nor did really generate the kinds of numbers that put it on a pedistal amoung worm-kind.
Slapper is only news to zealots and authors who are both new to information security and generally uninformed.
Actually, they do. [openbsd.org]
Better than that Lunix crap
They do?!
Hell, then I'm all for annexing them, especially since someone there knows about LUNIX.
BTW, I don't consider openBSD as good as LUNIX. I still can't get it to run on my Commie...
How come Slashdot never gets Slashdotted?
I might be wrong but I am under the impression that exploits are different from vulnerabilities. I am in the opinion that vulnerabilities are possible weakness that crackers/whoever can use to crack into a system while exploits acts that make use of these weaknesses to access the system. There might be no known exploits for some vulnerabilities (especially those discovered through code scanning)?
But it seems that most people seems to equate exploits with vulnerabilities. Am I wrong or what?
It's the time that your system is vulnerable that matters. When a bug in a linux system is found, it gets reported immediately, and usually there's a patch available within hours. Compare this to Windows where it can take weeks for a patch to be released.
A lot of the IIS exploits are built around "integration features" turned on by default and not well (at all?) documented. How do you disable what you don't know exists?
Some of them appear to be so obscure that their major use may well be the propergation of malware. "Intergration" can translate into write very bad, even "sphagetti", code.
And that's just IIS -- there's more hidden surprises buried in the OS known by hard-core developers and MS only.
It's quite possible that there are "black hats" who know about these...
Just make sure you run your Windows-box behind a Linux-based Firewall.
heheheh
Smoothwall Rocks!
Free ?! Does that mean I can't get a Discount ?!
This message was
Excerpt from a conversation between a customer support person and a
customer working for a well-known military-affiliated research lab:
Support: "You're not our only customer, you know."
Customer: "But we're one of the few with tactical nuclear weapons."
- this post brought to you by the Automated Last Post Generator...